About NetScaler Zero-Touch cert management. I can see the certificates pushed to the NetScalers, but when I try binding them to a LB vServer I get this error:

you shouldn't have to bind anything. It is supposed to detect it as sni once you enable the zero ssl function.

I saw one vServer going up, but didn't see any certs bound to it indeed. How does it determine the SNI? In this particular case I had StoreFront servers with the same certificate in the service group, so does it use that one? What about if I create a Gateway vServer (behind NAT and the assigned IP doesn't resolve for the cert subject... NetScaler just binds the cert when the first connection attempt for the specific GW hits?)

It's part of the SSL negotiation process to determine the URL hitting the LB or CSW to attach the proper certificate. VPN Gateways right now aren't supported for zero touch, those should allow you to bind one of those those remote certificates to it. There is a process in the documentation about creating pattern sets if you wish to limit which sni certificates can be bound to which vserver.

ok

Tested in my lab. They are delivered to the Zero touch devices that are onboarded. And they get used in real-time when an SNI match takes place. One thing I have noticed is that you can use zero touch on a vip, or you can use local certs on a vip. But you can't use both zero touch AND local certs at the same time on the same vip.