Hi, is there already a way to automatically renew the certificates on the Netscalers, so that in 2029 you don't have to hire someone who only update certificates?https://www.bleepingcomputer.com/news/security/ssl-tls-certificate-lifespans-reduced-to-47-days-by-2029/

ADM with an automated ACME challenge

Wishful thinking, that would be the best. But, we're not there yet.. hopefully it'll be a priority on the roadmap.

ACME is on the NetScaler Console roadmap. That is what the zero touch SSL function is for. I use powershell scripts with poshacme currently on my lets encrypt currently for renewals every 3 months. https://www.jeffriechers.com/wiki/automated-lets-encrypt-netscaler-certificate-update-process/

Yep, happily aware of that! But I don't want to have the need for a third-party solution (we use Ansible for a few environments), but it's.. well, a silly step. Kemp can do it per instance, FWIW.

Deploying ADM has been my standard in every NS depolyment. Even with single instance units. For off NS backups, Syslog, SNMP, etc. Adding certs to it is going to be an easy deployment IMHO.

Same for us, integral part of our services.

My current blocker to going fully automated is DNS verification. Our DNS provider doesn’t offer DNS management over API unless we upgrade our plan... or host more domains with them.

I was using godaddy until they changed their rules. So I host my DNS in Azure now. Only a few bucks a month and part of my visual studio credit usage.

Nailed it, I didn't want to name/shame.

They currently support Venafi and have several other providers in the works. Let's Encrypt will probably not get as much attention at first because commercially (i.e. top 2000 accounts) Let's Encrypt is not accepted due to it's lack of deeper verification of the source etc. The larger accounts steer the ship, so the providers they use will get added first (Sectigo, etc.). But, I definitely expect all providers to start to adopt a "standard" of some sort, as renewing certificates much more frequently will be a necessity very shortly. You can read about Venafi automation here: https://docs.netscaler.com/en-us/netscaler-console-service/application-analytics-and-management/dashboard/automate-ssl-management.html

One challenge we have on top of the DNS thingy is that we run NetScalers as a managed service for many customers and the certificates are managed by the customer. We just simply can’t have it like that in the future any more…

TLS certificates in the broadest sense of the word, NetScaler, servers themselves, interested how this will work out.