Automatic renewal
An internal scheduler checks the expiry dates and renews one certificate at a time, to stay within the authorities' rate limits. A renewal can also be started by hand from the interface or from the REST API.
Corellix Software Engineering
Solutions
NetScaler-ACME
NetScaler-ACME
Certificates that renew themselves, on every NetScaler.
NetScaler-ACME is a Linux service that requests and renews SSL/TLS certificates over the ACME protocol, from Let's Encrypt or another ACME authority, and installs them on NetScaler ADC through the NITRO REST API. It updates the certificate already bound to the virtual servers, saves the configuration and tells you what it did.
- NetScaler ADC 13.x · NITRO REST API
- Let's Encrypt and other ACME authorities
- RPM · DEB · Docker
Renewal without downtime
The new certificate takes the place of the old one in the same certkey: the virtual servers keep running.
30 days ahead
A check every six hours renews each certificate well before it expires; both values are settings.
Every action notified
E-mail and webhook on renewals, warnings and errors, and an append-only audit log.
Least privilege on NetScaler
A dedicated NITRO user whose command policy only allows SSL files, certkeys and saving the configuration.
Try NetScaler-ACME right here
A web interface for the whole team. Below, on sample data, the scheduler renews a certificate close to expiry: follow the job log line by line, check which NetScaler vServers are ready for the HTTP-01 challenge and try «Rinnova» on a certificate.
The interface is the product's own, in its original language; the data are sample data and the simulation is not connected to any system.
The problem
Ninety days go by quickly
Let's Encrypt certificates last ninety days, and certificate lifetimes across the industry keep getting shorter. On NetScaler every renewal is the same manual sequence: request the certificate, upload certificate and key, update the certkey, link the chain, save the configuration.
Multiplied by tens of domains and several appliances, it becomes a calendar of deadlines in which one forgotten renewal is a site that stops answering over HTTPS.
The answer
One service that does the whole sequence
NetScaler-ACME keeps the list of certificates, NetScaler appliances and ACME accounts. When a certificate gets close to expiry it requests a new one, validates the domain with the HTTP-01 challenge routed by the NetScaler itself, uploads the files over NITRO, updates the certkey and saves the configuration.
The web interface shows what is about to expire, what has been renewed and what went wrong, with the log of every job.
What NetScaler-ACME does
Rotation without downtime
The new files are uploaded under a timestamped name and the certkey is updated in place. The old files are deleted only afterwards, and kept if the issuing authority has changed.
NetScaler inventory
Reads certkeys and virtual servers from every registered appliance, shows which certificates are managed and which are not, and checks whether the HTTP-01 challenge can be routed.
Several ACME authorities
Let's Encrypt, production and staging, and Buypass out of the box; ZeroSSL, Google Trust Services and SSL.com with External Account Binding. Other ACME v2 directories can be added.
Notifications and audit
E-mail over SMTP and a generic webhook on every relevant event, an append-only log of who did what, and the history of every job with its log.
Built to be operated
Secrets encrypted at rest, local users, RPM and DEB packages with a systemd unit or a Docker image, backup and restore scripts.
One run, step by step
-
1
Register the NetScaler
The NSIP address and a dedicated NITRO user with least privileges; the connection test reads the appliance right away.
-
2
Route the challenge
A responder or content switching policy sends /.well-known/acme-challenge/ to the service. The interface writes the NetScaler commands for you.
-
3
Add the certificates
Common name, alternative names, ACME authority and the certkey to update on the NetScaler.
-
4
Let it run
Every check renews what is close to expiry, updates the certkey, saves the configuration and notifies you.
What it takes
- NetScaler
- NetScaler ADC 13.x, NITRO REST API over HTTPS (443)
- Where it runs
- Linux VM: RPM for RHEL, Rocky and Alma 9, DEB package, or Docker image
- Validation
- HTTP-01: port 80 of the published domains, routed by the NetScaler to the service
- Authorities
- Any ACME v2 directory, with or without External Account Binding
- NetScaler account
- Dedicated system user with a command policy limited to SSL files, certkeys and save ns config
- How you use it
- Web interface in the browser, REST API
What people ask us
Does the service have to be reachable from the Internet?
Not necessarily. The NetScaler can pass the validation requests to the service with a content switching policy, so the service stays on the internal network. The interface writes the commands, and its DNS and NAT guide explains the alternatives.
Are wildcard certificates supported?
Not yet: wildcards need the DNS-01 challenge, which is on the roadmap. Today validation is HTTP-01.
What happens if a renewal fails?
The current certificate stays on the NetScaler untouched, you receive the error by e-mail or webhook, and the job log shows the step where it stopped. The next check tries again.
Does it work with several NetScalers?
Yes. Each certificate is tied to the appliance and the certkey it updates, and the inventory reads all the registered appliances.
Is it an official NetScaler product?
No. It is a product of Corellix Software Engineering that uses the public NITRO REST API. NetScaler is a trademark of Cloud Software Group, Inc.
Coming next
What is planned next. If you need one of these sooner, say so in your request.
- DNS-01 challenge and wildcard certificates
- Single sign-on with OIDC
- Secrets in HashiCorp Vault
Let's talk
Tell us how many certificates you renew by hand
We will show you NetScaler-ACME on a test appliance and help you route the first validation on yours.
Rather write to us? Contact page
NetScaler-ACME is designed, built and supported by Corellix Software Engineering: the team behind the Corellix platform, which also builds custom software, infrastructure tools and data migrations.
About us All solutions