At the moment, public CA SSL/TLS-Certificates use a maximum Lifetime of 199 Days. Until March 2029, it will be reduced to 47 Days - time to rethink your Zertificate-Management-Design. For Services provided by Citrix NetScaler, there's a solution. Zero-Touch Certificate Management with Auto-Renewal, powered by NetScaler Console or NetScaler Console Service. One-Shot configured, runs without any more hours spent of typical cert-management stuff. See my insights and some limitations on that neat feature here. julianjakob.com/netscaler-zero-touch-certificate-management-ztcm

Thanks Julian! Do you know if this process works with wildcard certs as well? Any gotchas with SNI there?

Yes, Wildcard is also working and supported. SNI should work fine with most of clients / browsers these days. Only old legacy clients / OS do have problems to send the SNI-Header, so ZTCM can't provide any certificate back and the TLS handshake will fail