How to change Certificate on Citrix StoreFront

Learn how to manually replace the TLS certificate on Citrix StoreFront, update IIS HTTPS bindings across the server group, and verify user access.

StoreFront client-facing HTTPS is an IIS binding. Its TLS certificate belongs in the Windows Local Computer Personal store; it is not one of StoreFront's internal Citrix Delivery Services certificates.

Before you begin

Obtain a PFX whose SAN includes the StoreFront base URL, load-balanced name, and server FQDNs used for direct health checks. Record the IIS site/binding on every server and the gateway or load balancer's backend trust configuration.

Step-by-step certificate replacement

Import the PFX into Certificates (Local Computer) > Personal on every StoreFront node.
In IIS Manager, select the StoreFront website > Bindings, edit the https binding, preserve IP/port/hostname/SNI, and select the new certificate.
Repeat on every server in the StoreFront group. Do not modify the Citrix Delivery Services certificate store; Citrix says its internal service certificates are not TLS server certificates.
If a load balancer or NetScaler validates backend certificates, update its trust chain or pinning. No StoreFront configuration propagation step replaces a local IIS certificate on peer servers.

Product-specific considerations

An IIS binding change normally takes effect for new handshakes without iisreset. Recycling StoreFront application pools can log browser users out, so do not recycle them merely for the certificate. When a gateway terminates public TLS, still validate the separate gateway-to-StoreFront certificate path.

Verify the new certificate

Test the StoreFront base URL, Receiver/Workspace discovery, application enumeration, and a launch. Test each server directly with the public hostname supplied as SNI, then test through the load balancer.

Rollback

Reselect the old certificate on every IIS binding. Restore any load-balancer backend trust changes and re-run a launch test.

Common problems

The load-balanced base URL is absent from SANs.
Only one StoreFront node was updated.
Internal StoreFront certificates were modified instead of the IIS binding.
A backend health monitor does not trust the new issuing chain.

Automating certificate replacement with aethercert

The aethercert Citrix StoreFront target imports the certificate and updates the local IIS HTTPS binding. Apply it to every StoreFront server that can receive traffic.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.