Replace the SSL Certificate on Citrix StoreFront

StoreFront's client-facing HTTPS is an IIS binding. Its certificate lives in the Windows Local Computer Personal store and is selected on the IIS site - it is not one of StoreFront's internal Citrix Delivery Services certificates, which you leave alone.

Before you beginCopy Anchor Link

• Get a PFX whose CN or SAN contains the StoreFront base URL - required. Behind a load balancer, the base URL usually is the load-balanced name. Citrix additionally recommends each server's own FQDN as a SAN, so you can test servers directly.
• Keep the old certificate in each server's store until the new one is verified.
• Record the IIS site and its https binding (IP, port, host name, SNI) on every server of the StoreFront server group.
• Record how the gateway (NetScaler) or load balancer trusts StoreFront's certificate: CA trust, or a pinned certificate.

Step-by-step certificate replacementCopy Anchor Link

1. Take the first server out of the load balancer, then import the PFX into Certificates (Local Computer) > Personal (certlm.msc) on it. Propagating changes in the StoreFront console does not copy IIS certificates to the other servers.
2. In IIS Manager, select the StoreFront site (usually Default Web Site) > Bindings, edit the https binding, keep IP, port, host name and SNI, select the new certificate and click OK. On Windows Server 2022 and later, the binding dialog also offers Disable Legacy TLS to refuse TLS versions older than 1.2.
3. Verify the server (below), put it back into the load balancer, and repeat on every server in the group.
4. If the gateway or load balancer pins the backend certificate or does not trust the new issuing CA, update its trust configuration.

An IIS binding change applies to new TLS connections without iisreset; signed-in users stay signed in. Do not recycle the StoreFront application pools just for the certificate - that can sign users out.

Product-specific considerationsCopy Anchor Link

When a NetScaler Gateway terminates the public TLS connection, the gateway's own certificate is what users see; StoreFront's certificate is then the backend leg between gateway and StoreFront. Citrix recommends HTTPS for that leg too, so both must be renewed - the gateway certificate as described in the NetScaler guide.

Only when moving StoreFront from HTTP to HTTPS for the first time: add the https binding on every server, then change the base URL to https:// in the StoreFront console and propagate the change. A routine certificate renewal does not touch the base URL.

Verify the new certificateCopy Anchor Link

Test each server directly, with the public name as SNI, then through the load balancer (any machine with OpenSSL, or open the base URL in a browser and inspect the certificate):

openssl s_client -connect sf01.example.com:443 -servername storefront.example.com -showcerts </dev/null

Check subject and SAN, issuer, expiry date and the chain. Then open the base URL in a browser, let Citrix Workspace app discover the store, list the apps and launch one.

RollbackCopy Anchor Link

Select the old certificate on the https binding of every server, undo changes to the gateway or load-balancer trust, and run a launch test.

Common problemsCopy Anchor Link

• The base URL or the load-balanced name is missing from the SANs.
• Only one StoreFront server was updated.
• StoreFront's internal Delivery Services certificates were changed instead of the IIS binding.
• A health monitor on the load balancer does not trust the new issuing CA.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert Citrix StoreFront target imports the certificate and updates the local IIS HTTPS binding. Apply it to every StoreFront server that can receive traffic.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Citrix: securing StoreFront with HTTPS
• Citrix: certificates in StoreFront
• Citrix: StoreFront base URL