NetScaler

Documentation Index

Fetch the complete documentation index at: https://infisical.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

Prerequisites

• A NetScaler Connection with NITRO API access
• The NetScaler must be accessible over HTTPS from Infisical (directly or via an Infisical Gateway)
• User account with permissions to manage SSL certificates and bind them to vservers

​

Create a NetScaler Sync

curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/netscaler \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-netscaler-cert-sync",
    "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "an example certificate sync",
    "connectionId": "550e8400-e29b-41d4-a716-446655440000",
    "destination": "netscaler",
    "isAutoSyncEnabled": true,
    "certificateIds": [
        "550e8400-e29b-41d4-a716-446655440000"
    ],
    "syncOptions": {
        "canRemoveCertificates": true,
        "preserveItemOnRenewal": true,
        "certificateNameSchema": "myapp-{{certificateId}}"
    },
    "destinationConfig": {
        "vserverName": "vs-ssl-prod"
    }
}'

{
    "pkiSync": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-netscaler-cert-sync",
        "description": "an example certificate sync",
        "destination": "netscaler",
        "isAutoSyncEnabled": true,
        "destinationConfig": {
            "vserverName": "vs-ssl-prod"
        },
        "syncOptions": {
            "canRemoveCertificates": true,
            "preserveItemOnRenewal": true,
            "certificateNameSchema": "myapp-{{certificateId}}"
        },
        "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "connectionId": "550e8400-e29b-41d4-a716-446655440000",
        "createdAt": "2026-03-31T00:00:00.000Z",
        "updatedAt": "2026-03-31T00:00:00.000Z"
    }
}

​

Certificate Management

• Automatic Deployment: Deploy certificates in Infisical to NetScaler sslcertkey objects with customizable naming.
• Certificate Updates: Update certificates on NetScaler when renewals occur, with optional in-place replacement.
• vServer Binding: Automatically bind certificates to SSL virtual servers for seamless load balancer integration.
• Expiration Handling: Optionally remove expired or revoked certificates from NetScaler (if enabled).
• Configuration Persistence: Automatically save the NetScaler running configuration after each sync to persist changes across reboots.

​

How It Works

1. Logs in to the NetScaler NITRO API using the configured credentials.
2. For each certificate:
   • Uploads the certificate file (.cer) to /nsconfig/ssl/.
   • Uploads the private key file (.key) to /nsconfig/ssl/.
   • Creates or updates an sslcertkey object linking the cert and key.
   • If a vServer is configured, binds the certkey to the SSL virtual server.
3. Saves the running configuration to persist changes across reboots.
4. Logs out of the session.

​

Certificate Renewal Behavior

• Preserve enabled (default): The existing certkey object is updated in place with the new certificate content. The certkey name and any vServer bindings are preserved. This is ideal for production environments where services reference the certkey by name.
• Preserve disabled: A new certkey object is created with a unique name. The original certkey remains on the NetScaler. Both certificates coexist until the original is revoked or removed.

​

Removing Certificates

1. Unbinds the certificate from any configured SSL virtual server.
2. Deletes the sslcertkey object.
3. Deletes the certificate and key files from /nsconfig/ssl/.
4. Saves the configuration.

​

Manual Certificate Sync

• Initial setup when you have existing certificates to deploy
• One-time sync of specific certificates
• Testing certificate sync configurations
• Force sync after making changes

​

FAQ

​

What’s Next?