NetScaler creates a multiple domain name certificate (SAN)

1. Create an OpenSSL configuration file on the local computer by modifying the following code to the fields you need.

Note 1: in the example used in this article, the configuration file is named "req.conf".

Note 2: "req_extensions" will put the alternate name of the subject in CSR, while "x509_extensions" will be used when creating the actual certificate file.

[req]

Distinguished_name = req_distinguished_name

Req_extensions = v3_req

Prompt = no

[req_distinguished_name]

C = CN

ST = province

L = city

O = company

OU = organizational unit

CN = www.company.com

[v3_req]

KeyUsage = keyEncipherment, dataEncipherment

ExtendedKeyUsage = serverAuth

SubjectAltName = @ alt_names

[alt_names]

DNS.1 = www.company.com

DNS.2 = company.com

DNS.3 = www.company.net

DNS.4 = company.net

two。 Upload the file to the / nsconfig / ssl directory on the NetScaler device.

3. Log in to the NetScaler command line interface as nsroot and switch to the shell prompt.

Run the following command to create a certificate signing request and a new key file (note that due to the CA version, you may need to change sha256 to sha1):

Shell

Cd / nsconfig/ssl

Openssl req-new-out company.com.csr-newkey rsa:2048-nodes-sha256-keyout company.com.key.temp-config req.conf

Run the following command to verify the certificate signing request:

Openssl req-text-noout-verify-in company.com.csr

Run the following command to move the Key file to the correct format used on NetScaler:

Openssl rsa-in company.com.key.temp-out company.com.key

Rm company.com.key.temp

4. Download the certificate signing request file "company.com.csr" and provide it to your certification authority for signature.

5. Upload the certificate provided by the certification authority to the / nsconfig/ssl directory on the NetScaler device and install the certificate using the "company.com.key" file you created earlier.