How do I Create a Certificate Signing Request (CSR) on NetScaler?

This article describes how to create a Certificate Signing Request (CSR) on NetScaler.

Background

Setting up PKI environment involves set of steps and generating a CSR file is key to it. Getting a public certificate to host your domain is a must before anyone can interact with you. CSR is generated based on your private key and public details which you want to include in the certificate. Certificate is always generated by a CA (certificate authority) while you never share your private key with the CA. The CSR file is shared with CA and it drives generation of certificate for the end domain.

Hence any web site that is to use SSL must generate a Certificate Signing Request (CSR), an electronic document that contains a public key and a company/domain name. The certificate must then be signed/attested by a digital signature from a certificate authority (CA). The signed/attested certificate returned by the CA contains the site’s public key and company/domain name along with the CA’s endorsement.

To generate a CSR (certificate signing request), RSA key need to be created first. To create RSA keys please refer “How do I setup RSA keys on NetScaler?”. After the creation of RSA key, create CSR and submit it to a trusted CA (like DigiCert) to order for an SSL Certificate.

Complete the following steps to create a CSR on NetScaler:

Step 1: Go to Traffic Management > SSL > Create Certificate Signing Request (CSR).

Step 2: Fill the Create Certificate Signing Request (CSR) form shown below.

Request File Name: Name for and, optionally, path to the certificate signing request (CSR). /nsconfig/ssl/ is the default path.

Key FileName: Name of and, optionally, path to the private key used to create the certificate signing request, which then becomes part of the certificate-key pair. The key must be present in the appliance's local storage. /nsconfig/ssl is the default path.

• In the Browse drop-down list, select Appliance.

• Browse, select the RSA file created and click open.

Key format: Select PEM. PEM is the recommended format for your SSL Certificate.

Fill the company information in the Distinguished Name Fields section.

Fill the attribute fields.

• Challenge Password: To use later during certificate installation.

Click Create to finish the creation of CSR. Created CSR need to be sent to CA for signing and the process for the same is mentioned in the below steps.

Step 3: Go to Traffic Management >SSL > Manage Certificates/keys/CSRs.

Step 4: Select the created certificate and click View.

Step 5: Send the certificate content to Certificate Authority for signing.

Reference:
http://docs.citrix.com/en-us/netscaler/10-5/ns-reference-con/netscaler-command-reference/ssl/ssl-certreq.html

Example: