There should be a corresponding error on the STAs as well, but it appears that the NetScaler is not trusting the STA or vice versa. Also, are the STAs being load-balanced? It could be that server A created the ticket, and the NetScaler is asking server B to validate it. The NetScaler generally will not have an issue with the certificate.

No errors at all, just confusing... I'll continue the troubleshooting process later.

You can collect a capture while the process is going on to see where the STA was validated. ALso, you didn't answer if they were load-balanced. Even if you load balance the delivery controllers for Director or another reason, you should not load balance the STAs. They need to be idividually listed on both the StoreFront and the Gateway sites.

I suspect its the missing DNS resolution as EnableVDA SSL has been executed. NO VIP for LB is in place, only the inbuild loadbalancing on SF.

You can test the DNS resolution from the NetScaler CLI by issuing the command "sho dns addrec ctxddc01ltsr.citrix7202.lab" and it should return the IP address of the record.

It was DNS. ICMP and DNS Resolve had to be allowed by the firewall. When allowing those two services, the status for the STA went up and I could connect to the VDA.