Anyone able to get Zero Touch working with NetScaler VPN Gateway and AAA? When I enabled it in my lab after nfactor my storefront page just spun and spun and spun. Had to disable zerotouch to get it back.

are you putting together any documentation around this? It's getting to be a pretty hot topic.

Yup yup. Had a client that broke their nfactor as well with it. Hoping to have something by EOW.

noice!

I'm being really bad about asking questions in threads that are not directly related...but... What is everyone doing for backend services where it's not SSL offload? MSExchange (or any IIS server with Extended Protection enabled) for example, where the CS vServer and backend Exchange certs have to be swapped at the same time or else you get a channel binding token mismatch? Does that auto disqualify something like Zero Touch and you handle the automation elsewhere (something that can handle both the NS vServers and the backend services)?

agreed, hoping this can address the whole stack, aka director/storefront/delivery controllers, and if it can do those, i'm guessing it could handle non citrix related servers that have certs

I usually do internal certs off of my internal cert authority with an obnoxiously large lifetime. Since it is the clients that are looking for these shorter lifetimes I haven't had issues as of yet.

I'm talking about backend IIS servers with Extended Protection, where the internal cert and the cert bound to the LB vServer have to match...and be swapped out at the same time or else you get CBT errors.