Creating a public-facing server certificate
Next, you will create a public-facing server certificate and will have it signed (self-signed, that is) by the root CA certificate that you have just created in the previous section. To create a public-facing server certificate, perform the following steps:
Navigate to Traffic Management | SSL. Under SSL Keys, select the Create RSA Key option, as shown in the following screenshot:
First, you create the RSA key by entering Key Filename, Key Size(bits), Public Exponent Value as F4, and Key Format as PEM and then clicking on OK, as shown in the following screenshot:
Under Tools, select Create CSR (Certificate Signing Request). Enter a value in Request File Name and Key Filename that you have created in the previous step. Choose PEM as Certificate Format, create a password, and enter the values in the Distinguished Name Fields section. Then, click on OK, as shown in the following screenshot.
Note
Common Name must match Fully Qualified Domain Name that is used to access the Site; for example,
ng.xenpipe.comis what we will use to connect to NetScaler Gateway. In this example, we create a wildcard certificate that will work across all the subdomains; hence, you see*.xenpipe.comin the Common Name field. If you don't do this, the certificate will not work.
Next, we create the server certificate. Under SSL Certificates, select Create Certificate. Enter a name in Certificate File Name and select Server. Enter the Certificate Request File Name, choose PEM as Certificate Format, and enter the Validity Period (Number of Days). Enter a name in CA Certificate File Name, choose PEM as CA Certificate File format, and enter a name in the CA Key File Name field. Enter the passphrase and select the serial number file from the appliance named
ns-root.srl. These fields are provided so that the root CA that you have created earlier can sign and trust this server certificate. Fill them out and click on OK, as shown in the following screenshot. Thens-root.srlserial number file resides on NetScaler.Note
This is where we create the public-facing server certificate and simultaneously sign it (self-signed, that is) with the root CA certificate.
