I tried upgrading my ssl certificate on the delivery controller from my new CA (ecdsa sha384) on 2016 server (storefront and ddc on same server)… always seems to get: You have not chosen to trust the issuer of the server’s security certificate, (ROOT certificate).

Nobody?

check the chain for the cert

Are you getting this message when accessed via gateway or direct to storefront or both?

Hi Corey, they are not connected with Netscaler, so direct to storefront (storefront and controller on the same server)

Do the endpoints trust the root and intermediate CA?

Yes! It has no intermediate.

Does this help - read the part on key usage. https://support.citrix.com/article/CTX338545/storefront-unable-to-communicate-with-delivery-controllers-over-https

He! There was a problem with key usage. We have solved this issue; but the problem still persist. “An SSL connection could not be established: You have not chosen to trust the issuer of the server's security certificate, Root CA. This message was reported from the Citrix XML Service at address https://serveradress/scripts/wpnbr.dll. The specified Citrix XML Service could not be contacted and has been temporarily removed from the list of active services.”