How to change Certificate on Citrix NetScaler

Learn how to manually update a certificate-key pair on Citrix NetScaler, link intermediates, preserve vserver bindings, handle HA sync, and verify TLS.

NetScaler represents a server certificate and private key as an ssl certKey object. Updating that object in place preserves its SSL virtual-server bindings and reduces downtime compared with unbinding/removing/recreating it.

Before you begin

Record the certkey name, /nsconfig/ssl files, intermediate links, bound virtual servers/services, SNI flags, and HA state. Prepare PEM certificate/key files or a PFX supported by the current release.

Step-by-step certificate replacement

Upload the new files to /nsconfig/ssl using the GUI or SCP and protect the private key.
Update the existing object and inspect it:
```
update ssl certKey <certkey-name> -cert <new-cert.pem> -key <new-key.pem>
show ssl certKey <certkey-name>
```
Add -noDomainCheck only when a deliberate hostname/domain change makes it necessary. In GUI use Traffic Management > SSL > Certificates > Server Certificates > Update.
Inspect Cert Links. Install and link any new intermediate CA certificate before declaring success:
```
link ssl certkey <server-certkey> <issuer-certkey>
show ssl certlink
```
Verify the existing vserver bindings with show ssl vserver <name>. If a new certkey was created instead, bind it explicitly; existing completed handshakes can survive a binding replacement, while other in-progress connections can terminate.
Save configuration and synchronize certificate/key files in HA using NetScaler's SSL file synchronization procedure.

Product-specific considerations

Direct update is the low-downtime method. The older unbind/remove/add/bind sequence can make a virtual server DOWN between steps. Certificate-key bundles can be updated directly only from NetScaler 14.1 build 12.x; older releases require the documented unbind/recreate flow. Preserve SNI certificate flags and RSA/ECDSA combinations.

Verify the new certificate

Use show ssl certKey, show ssl certlink, and show ssl vserver, then test each SNI hostname over the network. Confirm HA file sync and test the peer before failover.

Rollback

Run update ssl certKey with the previous files, restore intermediate links, save, and sync HA. Avoid deleting either set until all vservers are validated.

Common problems

Certkey updated but intermediate link still points to an incompatible issuer.
Files exist on the primary but not the HA peer.
New certkey is never bound to the SSL vserver.
Domain checking rejects an intentional name change.

Automating certificate replacement with aethercert

The aethercert NetScaler target uploads the certificate/key, creates or updates the named sslcertkey, and uploads/links intermediate certificates. It intentionally does not bind the certkey to an SSL vserver, because that association is environment-specific.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.