<!-- BusyBot node reference — https://busybot.net/tools/netscaler/ -->

> Node: Citrix ADC (NetScaler) (`netscaler`) · Action (binary) · v1
> Category: Utility · Credentials: Netscaler ADC API (`netscalerApi`)
> Updated: 2026-08-16

# Citrix ADC (NetScaler)

> Manage SSL certificates and files on a Citrix ADC appliance

## Overview

The Citrix ADC (NetScaler) tool manages SSL certificates and files on a Citrix ADC appliance through the NITRO REST API. Supports two resources: (1) Certificate -- create self-signed Root-CA or CA-signed Intermediate/Server/Client certificates, and install certificate-key pairs for SSL termination. (2) File -- upload binary files to the appliance filesystem, download files as binary data, and delete files. File download produces binary output; file upload reads from the item binary property.

**Category:** Utility  
**Tool Name:** `netscaler`  
**Version:** 1

**Appearance:** Icon: `lucide-Server` | Color: `#452170`

## Node Type

**Action (Binary)** — handles file/binary data operations

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **Netscaler ADC API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/netscaler-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Certificate | `certificate` |
| File | `file` |

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Delete | `delete` | Delete a file from the appliance |
| Download | `download` | Download a file from the appliance |
| Upload | `upload` | Upload a file to the appliance |
| Create | `create` | Create (generate) an SSL certificate |
| Install | `install` | Install a certificate-key pair for SSL termination |

`delete`, `download` and `upload` belong to the **File** resource; `create` and `install` belong to the **Certificate** resource.

### Parameters

Every parameter below supports `{{ }}` expressions, so paths, file names and certificate names can come from the incoming item.

#### File: Upload

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| File Location | `string` | Yes | `/nsconfig/ssl/` | Destination directory path on the appliance (e.g. /nsconfig/ssl/). |
| Binary Property | `string` | Yes | `data` | Name of the binary property containing the file data to upload. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |
| Options | `collection` | No | `{}` | Optional upload settings. |
| — File Name | `string` | No | — | Override for the file name on the appliance. If empty, the original filename from binary data is used. |

#### File: Download

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| File Location | `string` | Yes | `/nsconfig/ssl/` | Directory path on the appliance where the file resides. |
| File Name | `string` | Yes | — | Name of the file (without path, just the filename). |
| Binary Property | `string` | Yes | `data` | Name of the binary property to store the downloaded file data. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |

#### File: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| File Location | `string` | Yes | `/nsconfig/ssl/` | Directory path on the appliance where the file resides. |
| File Name | `string` | Yes | — | Name of the file (without path, just the filename). |

#### Certificate: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Certificate File Name | `string` | Yes | — | Name for and, optionally, path to the generated certificate file. /nsconfig/ssl/ is the default path. |
| Certificate Format | `options` | Yes | `PEM` | Format in which the certificate is stored on the appliance. |
| | | | | Options: `PEM`, `DER` |
| Certificate Type | `options` | Yes | `ROOT_CERT` | Type of certificate to create. |
| | | | | Options: `ROOT_CERT` (self-signed Root-CA certificate; requires a private key file), `INTM_CERT` (Intermediate-CA certificate signed by a CA), `SRVR_CERT` (SSL server certificate for end-to-end encryption), `CLNT_CERT` (end-user client certificate for client authentication) |
| Certificate Request File Name | `string` | Yes | — | Name for and, optionally, path to the CSR file. /nsconfig/ssl/ is the default path. |
| Private Key File Name | `string` | Yes | — | Name and optional path to the private key file for Root-CA. Stored in /nsconfig/ssl/ by default. _(shown when Certificate Type is `ROOT_CERT`)_ |
| CA Certificate File Name | `string` | Yes | — | Name of the CA certificate file that signs this certificate. _(shown when Certificate Type is `INTM_CERT`, `SRVR_CERT`, `CLNT_CERT`)_ |
| CA Certificate File Format | `options` | Yes | `PEM` | Format of the CA certificate. _(shown when Certificate Type is `INTM_CERT`, `SRVR_CERT`, `CLNT_CERT`)_ |
| | | | | Options: `PEM`, `DER` |
| CA Private Key File Name | `string` | Yes | — | Private key file associated with the CA certificate used to sign this certificate. _(shown when Certificate Type is `INTM_CERT`, `SRVR_CERT`, `CLNT_CERT`)_ |
| CA Private Key File Format | `options` | Yes | `PEM` | Format of the CA private key. _(shown when Certificate Type is `INTM_CERT`, `SRVR_CERT`, `CLNT_CERT`)_ |
| | | | | Options: `PEM`, `DER` |
| CA Serial File Number | `string` | Yes | — | Serial number file maintained for the CA certificate. _(shown when Certificate Type is `INTM_CERT`, `SRVR_CERT`, `CLNT_CERT`)_ |
| Additional Fields | `collection` | No | `{}` | Optional certificate creation parameters. |
| — PEM Passphrase | `string` | No | — | Passphrase for the encrypted private key or CA key. |
| — Subject Alternative Name | `string` | No | — | Subject Alternative Name (SAN) extension value, e.g. `DNS:example.com,DNS:www.example.com`. |
| — Validity Period (Days) | `string` | No | — | Number of days the certificate will be valid. |

#### Certificate: Install

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Certificate-Key Pair Name | `string` | Yes | — | Unique name for the certificate and private-key pair. |
| Certificate File Name | `string` | Yes | — | Path to the X509 certificate file on the appliance. /nsconfig/ssl/ is the default path. |
| Private Key File Name | `string` | Yes | — | Path to the private key file on the appliance. /nsconfig/ssl/ is the default path. |
| Certificate Format | `options` | Yes | `PEM` | Format of the certificate and private-key files. |
| | | | | Options: `PEM`, `DER` |
| Password | `string` | Yes | — | Passphrase for PEM-formatted certificate and key files. Leave empty when the key is not encrypted. _(shown when Certificate Format is `PEM`)_ |
| Notify When Expires | `boolean` | Yes | `false` | Whether to enable an alert when the certificate is about to expire. |
| Notification Period (Days) | `number` | Yes | `10` | Days before certificate expiry at which to generate an alert. Between 10 and 100. _(shown when Notify When Expires is `true`)_ |
| Certificate Bundle | `boolean` | No | `false` | Whether to parse the certificate chain as a single file after linking the server certificate to its issuer. _(shown when Certificate Format is `PEM`)_ |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `5` | Maximum number of items to process concurrently. Keep low for appliance management APIs. |

## Output Data

Every operation **merges its result onto the input item JSON** — the incoming fields pass through unchanged — and produces **one output item per input item**. No operation fans out.

| Resource / Operation | Fields merged onto the item | Binary |
|----------------------|-----------------------------|--------|
| `file` / `upload` | `success: true` | The item's binary is forwarded unchanged; nothing new is written. |
| `file` / `download` | `filename`, `filelocation`, `fileSize` (bytes) | The downloaded file is written to the named **Binary Property**, alongside any binary the item already carried. Its MIME type is detected from the file name and contents. |
| `file` / `delete` | `success: true` | Forwarded unchanged. |
| `certificate` / `create` | `success: true` | Forwarded unchanged. |
| `certificate` / `install` | `success: true` | Forwarded unchanged. |

Only `file` / `download` returns detail; the other four confirm the call succeeded and rely on the Error output (or the workflow stopping) to signal failure. Reference the result downstream by expression, e.g. `{{ $json.filename }}` or `{{ $json.success }}`.

## Usage Examples

- Download an SSL certificate from the ADC appliance
- Upload a PEM file to /nsconfig/ssl/
- Create a self-signed Root-CA certificate
- Install a certificate-key pair for SSL termination
- Delete an obsolete certificate file from the appliance

## Example Configuration

Upload a file from an upstream node into the appliance's SSL directory, renaming it:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "file",
    "operation": "upload",
    "fileLocation": "/nsconfig/ssl/",
    "binaryPropertyName": "fileData",
    "options": {
      "fileName": "server-cert.pem"
    },
    "maxConcurrency": 3
  }
}
```

Download a certificate file off the appliance into binary data:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "file",
    "operation": "download",
    "fileLocation": "/nsconfig/ssl/",
    "fileName": "{{ $json.certFile }}",
    "binaryPropertyName": "downloadedData",
    "maxConcurrency": 2
  }
}
```

Delete a superseded certificate file:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "file",
    "operation": "delete",
    "fileLocation": "/nsconfig/ssl/",
    "fileName": "old-cert.pem"
  }
}
```

Create a self-signed Root-CA certificate valid for ten years:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "create",
    "certificateType": "ROOT_CERT",
    "certificateFileName": "root-ca.pem",
    "certificateFormat": "PEM",
    "privateKeyFileName": "root-ca-key.pem",
    "certificateRequestFileName": "root-ca.csr",
    "additionalFields": {
      "days": "3650",
      "pempassphrase": "rootca123"
    }
  }
}
```

Create a CA-signed server certificate with subject alternative names:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "create",
    "certificateType": "SRVR_CERT",
    "certificateFileName": "server.pem",
    "certificateFormat": "PEM",
    "certificateRequestFileName": "server.csr",
    "caCertificateFileName": "ca-cert.pem",
    "caCertificateFileFormat": "PEM",
    "caPrivateKeyFileName": "ca-key.pem",
    "caPrivateKeyFileFormat": "PEM",
    "caSerialFileNumber": "ca-serial",
    "additionalFields": {
      "days": "365",
      "subjectaltname": "DNS:www.example.com,DNS:example.com"
    }
  }
}
```

Create an Intermediate-CA certificate signed by that root:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "create",
    "certificateType": "INTM_CERT",
    "certificateFileName": "intermediate-ca.pem",
    "certificateFormat": "PEM",
    "certificateRequestFileName": "intermediate-ca.csr",
    "caCertificateFileName": "internal-ca.pem",
    "caCertificateFileFormat": "PEM",
    "caPrivateKeyFileName": "internal-ca-key.pem",
    "caPrivateKeyFileFormat": "PEM",
    "caSerialFileNumber": "ca-serial.txt",
    "additionalFields": {
      "days": "3650"
    }
  }
}
```

Install a certificate-key pair for SSL termination, with an expiry alert:

```json
{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "install",
    "certificateKeyPairName": "web-server-ssl",
    "certificateFileName": "/nsconfig/ssl/server.pem",
    "privateKeyFileName": "/nsconfig/ssl/server-key.pem",
    "certificateFormat": "PEM",
    "password": "cert123",
    "notifyExpiration": true,
    "notificationPeriod": 30,
    "certificateBundle": true
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manage SSL certificates and files on a Citrix ADC (NetScaler) appliance -- upload, download, delete files and create/install certificates.

### Behavior notes

- **Certificate Type changes which fields you must fill.** `ROOT_CERT` needs a private key file; the other three need the five CA fields instead. The editor hides the ones that do not apply, and the item fails if a required one is blank.
- **Create needs a CSR.** Both the certificate file name and the certificate request (CSR) file name are required for `create`, whichever type you pick.
- **Install expects files already on the appliance.** Upload the certificate and key with `file` / `upload` first, then reference their appliance paths in `install`.
- **Notification Period only applies with Notify When Expires on**, and the appliance accepts 10 to 100 days.
- **Keep concurrency low.** Appliance management APIs are not built for parallel load; the default of 5 is already generous for most appliances.

### Common patterns

- **SSL certificate lifecycle** — upload the purchased certificate and key with `file` / `upload`, then bind them with `certificate` / `install` and switch on expiry notification.
- **Internal CA management** — create a Root-CA with `ROOT_CERT`, then create an Intermediate-CA with `INTM_CERT` that references the root's files, and issue server certificates with `SRVR_CERT`.
- **Certificate cleanup** — remove expired files from `/nsconfig/ssl/` with `file` / `delete`.