This message was deleted.
# citrix-netscalers
Slackbot
04/03/2023, 8:41 PMThis message was deleted.
k
Kees Baggerman
04/03/2023, 10:02 PM@John Billekens has a framework for this
k
Kari Ruissalo (WyW)
04/04/2023, 8:06 AMThere's some sort of Venafi integration in ADM also:
https://www.citrix.com/blogs/2021/03/22/automate-ssl-certificate-lifecycle-with-citrix-adm-and-venafi-integration/
Kari Ruissalo (WyW)
04/04/2023, 8:07 AMBut I think if this passes we'll start going towards LE certs
j
John Billekens
04/04/2023, 8:21 AMThanks @Kees Baggerman, indeed I've written a script to automate this. I explained this in a Citrix blog a while ago: https://www.citrix.com/blogs/2019/06/24/why-certificates-are-more-important-today-than-ever/ if you have questions or suggestions, please let me know.
r
Ryan Gallier
04/04/2023, 2:04 PM^---- This script rocks. Love it.
Ryan Gallier
04/04/2023, 2:06 PMJohn's will also swap out the Storefront cert with the same LE cert
m
Marco Hofmann
04/04/2023, 2:28 PM@John Billekens Do you know if this scripts works with Citrix Gateway VPX? This is the Gateway only VPX Edition, that's not really an ADC. If not, I would have to test that.
Marco Hofmann
04/04/2023, 2:44 PMHere is the License view:
Marco Hofmann
04/04/2023, 2:53 PMI searched a bit through the code, seems like there is already a solution for that, interesting.
r
Ryan Gallier
04/04/2023, 3:04 PMyes, it works with gateway using LBVip
Ryan Gallier
04/04/2023, 3:04 PMi've hounded him for enough features over the years. 😄
😁 1
j
John Billekens
04/04/2023, 3:36 PMIt should work in many situations. I haven't added something to use certs in other partitions, although that is on my to do list.
Important thing is that there need to be a http (80) vip answering from the internet on the ip resolved from the fqdn. Because the validation is dome via http not https. Normally cou can use a cs vip for that or a Load Balance vip using the same ip as the gateway.
John Billekens
04/04/2023, 3:37 PMIf not, let me know
m
Marco Hofmann
04/04/2023, 4:21 PM@Ryan Gallier You have a working example for a Gateway only license setup?
r
Ryan Gallier
04/04/2023, 4:38 PMI do. Generally i have a gateway vserver, and an LBVip, on the same IP. The LBVip i use as an 80 to 443 redirect. The script can piggie back on that.
❤️ 1
Ryan Gallier
04/04/2023, 4:39 PMfirst I create an API user
Ryan Gallier
04/04/2023, 4:39 PM.\GenLeCertForNS.ps1 -CreateUserPermissions -CreateApiUser -LBVipName "LAB-HTTP-to-HTTPS-Redirect" -ApiUsername "LAB-leuser" -ApiPassword "LEP@ssw0rd" -NSCPName "LABLePermissions" -NSUsername nsroot -NSPassword "nsroot" -ManagementURL "https://10.13.8.251" -SaveNSConfig
Ryan Gallier
04/04/2023, 4:40 PMThen create the cert
Ryan Gallier
04/04/2023, 4:40 PM.\GenLeCertForNS.ps1 -ConfigFile .\config.json -Username "LAB-leuser" -CN "gateway.fqdn.com" -EmailAddress "somedude@gmail.com" -PfxPassword "P@ssw0rd" -CertDir "C:\Certs" -ManagementURL "https://10.13.8.251" -UseLbVip -LbName "LAB_HTTPS_Redirect" -CertKeyNameToUpdate "gateway.fqdn.com" -DisableIPCheck -UpdateIIS -SaveADCConfig -Production
Ryan Gallier
04/04/2023, 4:41 PMThen you just run it nightly with a script.
Ryan Gallier
04/04/2023, 4:42 PMpowershell.exe -executionpolicy bypass c:\scripts\GenLeCertForNS.ps1 -AutoRun -ConfigFile .\config.json -Production
m
Marco Hofmann
04/04/2023, 5:11 PMThat is just wonderful!
Marco Hofmann
04/04/2023, 5:12 PMWill test that on a Gateway only VPX tomorrow! Thank you very much!
Marco Hofmann
04/04/2023, 5:36 PM@Ryan Gallier @John Billekens Which "version" of the script should one use?
1. https://github.com/j81blog/GenLeCertForNS/blob/master/GenLeCertForNS.ps1
2. https://github.com/j81blog/GenLeCertForNS/blob/dev/GenLeCertForNS.ps1
3. https://github.com/j81blog/GenLeCertForNS/releases/latest
I would guess and say nr 1. is the correct one to use in production?
r
Ryan Gallier
04/04/2023, 5:36 PMRyan Gallier
04/04/2023, 5:36 PM2.15.0
m
Marco Hofmann
04/04/2023, 5:47 PMSeems like Master and Dev Branch are the same (at the moment).
j
John Billekens
04/04/2023, 8:33 PMYes currently both are the same 🙂
John Billekens
04/04/2023, 8:35 PMSorry for my late replies, been very busy starting my own freelance consultant buissiness