{"id":3651,"date":"2017-07-01T13:14:58","date_gmt":"2017-07-01T09:14:58","guid":{"rendered":"https:\/\/rakhesh.com\/?p=3651"},"modified":"2017-07-01T13:19:35","modified_gmt":"2017-07-01T09:19:35","slug":"generating-certificates-with-san-in-netscaler-to-make-it-with-chrome-and-other-browsers","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/infrastructure\/generating-certificates-with-san-in-netscaler-to-make-it-with-chrome-and-other-browsers\/","title":{"rendered":"Generating certificates with SAN in NetScaler (to make it work with Chrome and other browsers)"},"content":{"rendered":"

I want to create a certificate for my NetScaler and get it working in Chrome. Creating a certificate is easy – there are Citrix docs etc for it – but Chrome keeps complaining about missing subjectAlternativeName. This is because Chrome 58 and upwards ignore the Common Name (CN)<\/a> field in a certificate and only check the Subject Alternative Names<\/a> (SAN) field. Other browsers too might ignore the CN field if the SAN field is present (they are supposed to at least<\/a>); so as a best practice it’s a good idea to fill the SAN field in my NetScaler certificate and put all the names (including the CN) in this field.\u00a0<\/p>\n

Problem is the NetScaler web UI doesn’t have an option for specifying the SAN field. Windows CA (which is what I use internally) supports SAN<\/a>\u00a0when making requests, but since the CSR is usually created on the NetScaler and that doesn’t have a way of mentioning SAN, I need an alternative approach.\u00a0<\/p>\n

Here’s one approach<\/a>\u00a0from a Citrix blog post. Typically the CLI loving geek in me would have taken that route and stopped at that, but today I feel like exploring GUI options. :)<\/p>\n

So I came across the DigiCert Certificate Utility and a guide<\/a> on how to generate a CSR using that. I don’t need to use the guide entirely as my CA is internal, but the tool (download link<\/a>) is useful. So I downloaded it and created a certificate request.\u00a0<\/p>\n

\"\"<\/p>\n

A bit of background on the above. I have two NetScalers: ns105-01.rockylabs.zero (IP 10.10.1.150) and ns105-02.rockylabs.zero (IP 10.10.1.160) in an HA pair. For management purposes I have a SNIP 10.10.1.170 (DNS name ns105.rockylabs.zero) which I can connect to without bothering which is the current primary. So I want to create a certificate that will be valid for all three DNS names and IP addresses. Hence in the Subject Alternative Names field I fill in all three names and IP address – note: all three names including the one I put in the common name<\/em>, since Chrome ignores this field (and other browsers are supposed to ignore the CN if SAN is present).<\/p>\n

I click Generate and the tool generates a new CSR. I save this someplace.\u00a0<\/p>\n

Now I need to use this CSR to generate a certificate. Typically I would have gone with the WebServer template in my internal CA, but thing is eventually I’ll have to import this CSR, the generated certificate, and the private key of that certificate<\/em> to the NetScaler – and the default WebServer template does not allow key exporting.\u00a0<\/p>\n

So I make a new template on my CA. This is just a copy of the default “Web Server” template, but I make a change to allow exporting of the private key (see checkbox below).<\/p>\n

\"\"<\/p>\n

Then I create a certificate on my CA using this CSR.\u00a0<\/p>\n

certreq -attrib \"CertificateTemplate:WebServer_withKey\"<\/pre>\n
The template name “WebServer_withKey” is the name of the template. Need to use that with the certreq<\/code> command instead of the display name.\u00a0<\/p>\n
\"\"<\/p>\n
This will create the certificate and save it at a location I specify.\u00a0<\/p>\n
At this point I have the CSR and the certificate. I can’t import these into the NetScaler as that also requires the private key. The DigiCert tool generates the private key automatically and keeps it with itself<\/a>, so we need to import this certificate into the tool and export with key from there<\/a>.\u00a0This exports the certificate, along with key, into a PFX format.\u00a0<\/p>\n
This Citrix article<\/a> is a good reference on the various certificate formats. It also gives instructions on how to import a PFX certificate into NetScaler.<\/p>\n
Before proceeding however, a quick summary of the certificate formats from the same article for my own reference:<\/p>\n