Question regarding enabling TLS 1.3 on the Netscaler. Looks like you have to enable the 'default profile' SSL Param, which says it can override a legacy profile if it's binded. Does a new front end 'default profile' get created or something? or exactly what is it going to override? https://support.citrix.com/s/article/CTX259045-citrix-adc-tls-13-is-not-working-if-enabled-through-ssl-profile?language=en_US

I'm unsure what they mean by legacy profiles, but we are enabling default profiles on all our installs. The ns_default_ssl_profile_frontend then becomes the default profile for all VIPs until you assign something different - we don't change the default profile, we create new ones as required for the various services (ie TLS 1.2 profile, TLS 1.3 profile, one for packet capture, etc etc)

Command: The following command enables the default profile and binds this profile to the SSL entities to which a profile is already bound. That is, if a profile (for example P1) is already bound to an SSL entity, the default front-end profile or the default back-end profile replaces P1. The older profile (P1) is not deleted. It is now an enhanced SSL profile and contains the earlier settings, and the ciphers and ECC curves. If you do not want the default profile, you can explicitly bind P1 to the SSL entity.

Apparently this is a thing. Never tested it. https://docs.netscaler.com/en-us/citrix-adc/current-release/ssl/ssl-profiles/ssl-profile-converter.html

SSL profiles are the new best practice as you can modify the profile, and all VIPs assigned to the profile are modified instead of going into each SSL VIP and adjusting the settings there. I have TLS 1.3 enabled on a few NetScalers that are currently not running profiles. What version and build are you referring to?