How to Create a CSR on Citrix NetScaler VPX?

Introductions

Most people try to generate a CSR the “official” way and end up lost in menus. If you want the simplest path, use the DigiCert® Certificate Utility for Windows. It’s essentially a shortcut: if you’re already on a Microsoft server or workstation, it handles CSR generation and more without requiring you to navigate the NetScaler UI.

But let’s say you want to do it yourself on Citrix NetScaler VPX. Here’s the catch: the steps aren’t identical across versions.

For example, in 10.1, the SSL node hides under Traffic Management, but in other versions, SSL might stand right at the top level. This is why tutorials often feel confusing. They’re right for one version but slightly wrong for yours.

The notes here were tested on NetScaler 10.1 VPX (50), but the process will feel familiar if you’re on any of these:

• NetScaler 9.3+ VPX
• NetScaler 10.0+ VPX
• NetScaler 10.1+ VPX
• NetScaler 10.5+ VPX

Or really, most VPX builds (10, 50, 200, 1000, 3000). The details move around a little, but the principle is the same.

Creating a CSR on NetScaler VPX

How to Create RSA Keys?

The first time you deal with SSL certificates on a device like NetScaler VPX, it feels oddly backwards. You can’t just ask for a certificate. Please first prove you own a key. That’s because SSL isn’t really about certificates. It’s about identity.

The RSA key you generate is your identity, and the CSR you make afterwards is just your way of introducing that identity to a certificate authority.

So the first step isn’t “generate a CSR.” It’s “make an RSA key.” Once you’ve got that, the CSR is easy.

Here’s how it works in Practice:

• Log in to the NetScaler console.
• On the left, head to Configuration → Traffic Management → SSL.
• Under SSL Keys, select Create RSA Key.

This opens a form. The intimidating part isn’t the process; it’s the jargon.

Here’s how to think about each field without drowning in cryptography:

Key Filename: This is merely the file that contains your RSA key. Name it whatever you want (“example.key” is ok), but do remember what it is called. Forgetting about them is to pick up your house keys.

Enter 2048 as the Key Size: Why not 1024? Computers are fast enough now that 1024-bit keys are breakable. Why not 4096? It does not bring much security, but it also makes things slower. 2048 is a sweet spot.

You will encounter options for 3 or F4 (0x10001): Both mathematically hold up. In the real world, everybody uses F4. It is the default mode for this reason.

Preferred Format: PEM. Practically all of SSL requires PEM. Additional formats are only a source of friction

PEM Encoding Algorithm (optional): You can pick DES or DES3 to encrypt the key file itself, but unless you have a compliance checkbox to tick, leave it blank. Simplicity beats unnecessary encryption layers.

Passphrase (optional): If you did pick DES or DES3, you’ll need a passphrase. This can protect your key, but it also means you’ll be typing it every time the device needs the key. A forgotten passphrase is worse than no passphrase at all.

Click OK, then Close, and you’re done. You’ve created an RSA key.

How to Create Your CSR?

Now that you’ve got your RSA key, you’re ready for the next step: the CSR. This is the moment when your key raises its hand and says, I’d like to be trusted, please.

The CSR (Certificate Signing Request) is what you send to a Certificate Authority (CA) like DigiCert so they can vouch for you. Think of it as a résumé for your server. It includes your public key and some basic information about who you are.

Here’s how you do it on NetScaler VPX:

• In the console, go to Configuration → Traffic Management → SSL.
• Under SSL Certificates, click Create CSR.

A new window opens. Don’t panic; it looks more complicated than it is.

Request File Name: This is just the file that will store your CSR. Call it something like example.csr.

Key Filename: Point it to the RSA key you made earlier (example.key). This ties your CSR to your key. Without that link, the CSR is meaningless.

Key Format: Pick PEM. It’s the standard, and everything else just causes headaches.

PEM Passphrase: Only matters if you encrypted your key. If you didn’t, skip it.

Now comes the “Distinguished Name Fields.” This is the human part of the CSR, the stuff that tells the CA who you are. Fill these carefully, because whatever you put here will end up stamped on your SSL certificate:

Country: The country where your company is legally based.

State/Province: Same deal: legal location, not where you happen to be working today.

Organisation Name: Your company’s official registered name. If your paperwork says Your Company, Inc., don’t shorten it to YC.

City: The city where your company is legally registered.

Email Address: Optional. Most people leave it blank.

Organisational Unit: Optional. You can put “IT” or “Security” here, but it’s mostly for your own labelling.

Common Name: This is the big one. It’s the domain name users will type in to reach you, “www.yourdomain.com” or just “yourdomain.com”. If you get this wrong, your shiny new certificate won’t match your site.

Then there are the “Attribute Fields.” These exist more for legacy reasons than necessity, but here’s what to do:

• Challenge Password: Enter something and keep a note of it. You may need it when installing your certificate.
• Company Name (optional): You can add it again here, but it’s redundant.

Click OK, then Close, and you’ve got your CSR.

To see what you just made, go back to Traffic Management → SSL → Tools → Manage Certificates / Keys / CSRs. Select your CSR file (say, example.csr) and click View. You’ll see a block of text starting with:

—–BEGIN NEW CERTIFICATE REQUEST—–

and ending with

—–END NEW CERTIFICATE REQUEST—–

That’s your CSR. Copy it exactly, including the lines and paste it into DigiCert’s order form.

Conclusion

When DigiCert asks you to pick your server type, choose Citrix (Other). That way, they’ll send you not just the SSL certificate but also the intermediate certificates you’ll need to make everything work on NetScaler. After DigiCert verifies your details and sends your certificate back, you’ll be ready to install it.

Next Step: How To Install an SSL Certificate On Citrix NetScaler VPX?