Skip to content

Provision certificates to Citrix ADC

Provision a certificate from Certificate Manager - SaaS to a Citrix ADC. Certificate Manager - SaaS uploads the certificate, its private key, and its CA certificates to the appliance, links them into a chain, and binds the certificate to a virtual server, service, or service group that already exists. Provisioning never creates the endpoint.

Before you begin

  • A Citrix ADC machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • The partition and the virtual server, service, or service group to bind the certificate to. Both must already exist on the Citrix ADC.

To provision a certificate to Citrix ADC

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, in Certificate Name, enter a base name for the certificate on the Citrix ADC.

    Certificate Manager - SaaS builds the final name from it. It removes characters other than letters, digits, hyphens, periods, and underscores, keeps the first 17 characters, and appends a hyphen and the first 8 characters of the certificate's SHA-256 fingerprint. If a different certificate already uses that name, Certificate Manager - SaaS appends a short unique suffix. If the same certificate is already on the Citrix ADC, Certificate Manager - SaaS reuses it instead of uploading a copy.

  6. In Chain Bundle Name, enter a base name for the CA certificates in the chain. Certificate Manager - SaaS names each CA certificate it uploads with this name, a sequence number, and four random characters, so the name doesn't need to be unique. If a CA certificate is already on the Citrix ADC, Certificate Manager - SaaS reuses it.

  7. (Optional) In Partition, replace the pre-filled value, Default, with the name of the partition to install the certificate in. The partition must already exist.

  8. Under Installation Endpoint, for Endpoint Type, choose the type of endpoint to bind the certificate to: Virtual Server, Service, or Service Group.

  9. In Endpoint Name, enter the name of the virtual server, service, or service group. It must already exist in the partition. If it doesn't, provisioning fails.
  10. (Optional) If you chose Virtual Server, enable SNI Certificate to bind the certificate as a Server Name Indication (SNI) certificate. Certificate Manager - SaaS first removes any SNI binding on the virtual server whose certificate has the same common name.
  11. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
  12. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS installs the certificate and its chain, binds the certificate to the endpoint, and saves the Citrix ADC configuration so the changes survive a restart. An installation then appears on the machine's Installations tab. Its Partition, Endpoint Type, and Endpoint Name values show where the certificate is deployed, so you can tell apart installations that share the same certificate. To provision on a schedule instead of right away, set up a machine provisioning schedule.