A NetScaler terminates TLS for everything behind it: the Citrix Gateway, StoreFront, internal web applications and public portals. When one of its certificates expires, every service bound to it fails at once. For most South African organisations the annual renewal has been a diary entry and a change ticket. That approach is about to stop working.
In April 2025 the CA/Browser Forum adopted Ballot SC-081v3, proposed by Apple and endorsed by Sectigo, Google Chrome and Mozilla. It reduces the maximum lifetime of a publicly trusted TLS certificate in stages, from 398 days to 47 days by March 2029. This article explains the timetable, and how the certificate tooling in NetScaler Console turns a yearly task into a routine that runs on its own.
The certificate lifetime schedule
The schedule adopted by the Forum, as summarised by DigiCert, has three steps:
- From 15 March 2026: maximum validity 200 days. This stage is already in force; a certificate issued today expires before the middle of 2027.
- From 15 March 2027: maximum validity 100 days.
- From 15 March 2029: maximum validity 47 days, and the period for which a certificate authority may reuse domain validation drops to 10 days.
Identity validation for OV and EV certificates also shortened in March 2026, from 825 to 398 days. The rules apply to public certificate authorities. Certificates from an internal enterprise CA, common on internal NetScaler virtual servers, are not bound by them, though shorter lifetimes are good practice there too.
The arithmetic matters. At 47 days, a NetScaler fronting 30 public services will need well over 200 certificate renewals a year. DigiCert's view is that manual renewal becomes untenable once the 100-day stage arrives in 2027.
Step 1: find every certificate you own
Start with an inventory. The SSL dashboard in NetScaler Console polls each managed instance and charts its certificates by issuer, key strength, signature algorithm and days to expiry. It separates used from unused certificates and self-signed from CA-signed, and lists the ten instances carrying the most certificates. Clicking a chart lists the certificates behind it with the instance, validity and algorithm.
Three things to look for on a first pass:
- Certificates bound to nothing. Unused certificates hide the ones that matter. On NetScaler 14.1-38.x and later, Console can delete the certificate files as well as the objects, for all unused certificates or only expired ones.
- Weak keys and old algorithms. The dashboard lets you compare the estate against a policy such as a minimum 2048-bit key and a trusted CA.
- Certificates nobody remembers issuing. The Links view shows the chain up to the root, which identifies the issuer and whether an intermediate is missing.
Step 2: get warned before anything expires
Under Infrastructure > SSL Dashboard > Settings > General, Console lets you set how many days before expiry a notification goes out and where: an email distribution list, Slack, PagerDuty or ServiceNow (the last through the Citrix Cloud ITSM Adapter). The documentation's example is 30 days.
Set the number with the new lifetimes in mind. A 30-day warning on a 47-day certificate fires two weeks after issue, which is noise. Warn at roughly a quarter of the certificate's lifetime, and send the alert to a queue that is worked rather than one administrator's inbox. The dashboard can also be exported daily, weekly or monthly by email or Slack.
Step 3: renew without touching each instance
When a renewed certificate arrives, Console's Update function replaces it from the certificate store and updates every SSL virtual server the old certificate was bound to, on every instance. If the file carries its chain, the linked intermediates update as well. This removes the per-appliance logon, the file copy and the risk of updating one node of a high-availability pair and forgetting the other.
Step 4: automate issue and renewal with ACME
The durable fix is to let the certificate renew itself. NetScaler Console supports the ACME protocol through the acme.sh client, and can request, validate and renew certificates from Let's Encrypt, DigiCert, Sectigo, Entrust, GlobalSign and other public and private authorities. NetScaler's position, in its November 2025 blog on shrinking lifetimes, is that certificates should issue, renew and deploy with no human intervention once configured.
The constraints to design around, from the Console documentation:
- DNS-01 is the only challenge type. Validation publishes a DNS record, so the zone must be hosted with a supported DNS provider. Amazon Route 53, Azure DNS, Cloudflare, Google Cloud DNS and GoDaddy are on the list; a provider not listed is not supported.
- Every domain on the certificate must map to a configured DNS provider, or renewal does not run.
- Set the renewal window in days before expiry. The documentation uses seven days as its example. Console checks validity periodically and renews within the window; Renew now forces it.
- Choose the store deliberately. Certificates in the ordinary certificate store still have to be deployed by an administrator. Certificates in the Zero-touch store deploy automatically, which is what makes the process hands-off.
- Avoid duplicates. A certificate held in both stores is renewed twice, and Console renews one certificate at a time.
The public name of the Citrix Gateway is the obvious first candidate. Internal certificates can follow where the enterprise CA supports ACME.
A checklist for the next twelve months
- Poll every NetScaler from Console and clear out unused certificates.
- Record who owns each public certificate and which DNS zone it validates against.
- Set expiry notifications to a queue, at roughly a quarter of the certificate lifetime.
- Move public certificates to ACME issuance into the Zero-touch store, one service at a time, starting with the Gateway.
- Rehearse the 100-day stage now: a renewal that takes a week of elapsed effort today will not keep up in 2027.
Certificate hygiene is one part of keeping the appliance safe. Our guide to NetScaler vulnerabilities covers patching, and the Citrix LAS deadline covers the licensing change that affected the same appliances earlier this year. OAS runs certificate monitoring and renewal as part of its managed NetScaler service.
Sources
- CA/Browser Forum: Ballot SC081v3, Introduce Schedule of Reducing Validity and Data Reuse Periods, accessed 6 November 2026.
- DigiCert: 1-year TLS/SSL certificates are here, what now?, accessed 6 November 2026.
- NetScaler Console documentation: Use the SSL dashboard, accessed 6 November 2026.
- NetScaler Console documentation: Set up notifications for SSL certificate expiry, accessed 6 November 2026.
- NetScaler Console documentation: Update an installed certificate, accessed 6 November 2026.
- NetScaler Console documentation: Automated Certificate Management Environment (ACME), accessed 6 November 2026.
- NetScaler blog: Certificate lifetimes are shrinking, your business continuity doesn't have to, dated 12 November 2025 and accessed 6 November 2026.
Take certificate expiry off the risk register with NetScaler deployed and managed by OAS.