Btw don't upload a certificate to ZTCM and set it to CUSTOM unless your instances are already set up to use that. it will unbind all the GLOBAL certs since it switches the Netscaler instance from GLOBAL to CUSTOM. Maybe I just need more sleep, but I was not expecting that. I thought it was also an individual setting for the cert and would have no impact on what the instance was set to.

No ZTCM is leading and will wipe the existing certs on the box https://support.citrix.com/external/article/CTX693217/understanding-zero-touch-certificate-man.html

I think we are saying the same thing in two different ways

Ah ok check

But they're helping!