This message was deleted.

The majority of times I've seen this have been licensing issues. Previously if a box thought it was unlicensed then it wouldn't accept the add ssl certkey and related commands. For HA specifically, it shouldn't be required but once you create the pair, before failing over I usually suggest doing a save config on the primary which triggers a full config sync to secondary. There also should be logs specific to sync and propagation that you can look at to see if anything failed in that process.

I'll look into those logs, thanks. The license was good to go on the new VPX, I did verify that before joining. We did have another issue where there were two default static routes listed for some reason, so perhaps that contributed to the initial cert sync issue.

Did you check the RPC? When adding a "new" HA node i always check / change RPC.. HA state could say it is synced correctly but not al config part will sync without correct RCP. (Never saw this with certificates but did with network configs).

Also along those lines, you should always change RPC node passwords from the defaults as well - recent versions of firmware will bark at you about this. Also use secure RPC, no real good reason to leave things in plaintext.

I’ve seen this a lot, restarting the sync service fixes it

I’ve seen this when upgrading Netscalers a couple of times. Certs were in the file system but binding disappeared.