Citrix ADC (NetScaler)

Manage SSL certificates and files on a Citrix ADC appliance

Overview

The Citrix ADC (NetScaler) tool manages SSL certificates and files on a Citrix ADC appliance through the NITRO REST API. Supports two resources: (1) Certificate — create self-signed Root-CA or CA-signed Intermediate/Server/Client certificates, and install certificate-key pairs for SSL termination. (2) File — upload binary files to the appliance filesystem, download files as binary data, and delete files. File download produces binary output; file upload reads from the item binary property.

Category: Utility
Tool Name: netscaler
Version: 1

Appearance: Icon: lucide-Server | Color: #452170

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires Netscaler ADC API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Certificate	certificate
File	file

Operations

Operation	Value	Description
Delete	delete	Delete a file from the appliance
Download	download	Download a file from the appliance
Upload	upload	Upload a file to the appliance
Create	create	Create (generate) an SSL certificate
Install	install	Install a certificate-key pair for SSL termination

delete, download and upload belong to the File resource; create and install belong to the Certificate resource.

Parameters

Every parameter below supports {{ }} expressions, so paths, file names and certificate names can come from the incoming item.

File: Upload

Parameter	Type	Required	Default	Description
File Location	string	Yes	/nsconfig/ssl/	Destination directory path on the appliance (e.g. /nsconfig/ssl/).
Binary Property	string	Yes	data	Name of the binary property containing the file data to upload. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.
Options	collection	No	{}	Optional upload settings.
— File Name	string	No	—	Override for the file name on the appliance. If empty, the original filename from binary data is used.

File: Download

Parameter	Type	Required	Default	Description
File Location	string	Yes	/nsconfig/ssl/	Directory path on the appliance where the file resides.
File Name	string	Yes	—	Name of the file (without path, just the filename).
Binary Property	string	Yes	data	Name of the binary property to store the downloaded file data. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.

File: Delete

Parameter	Type	Required	Default	Description
File Location	string	Yes	/nsconfig/ssl/	Directory path on the appliance where the file resides.
File Name	string	Yes	—	Name of the file (without path, just the filename).

Certificate: Create

Parameter	Type	Required	Default	Description
Certificate File Name	string	Yes	—	Name for and, optionally, path to the generated certificate file. /nsconfig/ssl/ is the default path.
Certificate Format	options	Yes	PEM	Format in which the certificate is stored on the appliance.
				Options: PEM, DER
Certificate Type	options	Yes	ROOT_CERT	Type of certificate to create.
				Options: ROOT_CERT (self-signed Root-CA certificate; requires a private key file), INTM_CERT (Intermediate-CA certificate signed by a CA), SRVR_CERT (SSL server certificate for end-to-end encryption), CLNT_CERT (end-user client certificate for client authentication)
Certificate Request File Name	string	Yes	—	Name for and, optionally, path to the CSR file. /nsconfig/ssl/ is the default path.
Private Key File Name	string	Yes	—	Name and optional path to the private key file for Root-CA. Stored in /nsconfig/ssl/ by default. (shown when Certificate Type is ROOT_CERT)
CA Certificate File Name	string	Yes	—	Name of the CA certificate file that signs this certificate. (shown when Certificate Type is INTM_CERT, SRVR_CERT, CLNT_CERT)
CA Certificate File Format	options	Yes	PEM	Format of the CA certificate. (shown when Certificate Type is INTM_CERT, SRVR_CERT, CLNT_CERT)
				Options: PEM, DER
CA Private Key File Name	string	Yes	—	Private key file associated with the CA certificate used to sign this certificate. (shown when Certificate Type is INTM_CERT, SRVR_CERT, CLNT_CERT)
CA Private Key File Format	options	Yes	PEM	Format of the CA private key. (shown when Certificate Type is INTM_CERT, SRVR_CERT, CLNT_CERT)
				Options: PEM, DER
CA Serial File Number	string	Yes	—	Serial number file maintained for the CA certificate. (shown when Certificate Type is INTM_CERT, SRVR_CERT, CLNT_CERT)
Additional Fields	collection	No	{}	Optional certificate creation parameters.
— PEM Passphrase	string	No	—	Passphrase for the encrypted private key or CA key.
— Subject Alternative Name	string	No	—	Subject Alternative Name (SAN) extension value, e.g. DNS:example.com,DNS:www.example.com.
— Validity Period (Days)	string	No	—	Number of days the certificate will be valid.

Certificate: Install

Parameter	Type	Required	Default	Description
Certificate-Key Pair Name	string	Yes	—	Unique name for the certificate and private-key pair.
Certificate File Name	string	Yes	—	Path to the X509 certificate file on the appliance. /nsconfig/ssl/ is the default path.
Private Key File Name	string	Yes	—	Path to the private key file on the appliance. /nsconfig/ssl/ is the default path.
Certificate Format	options	Yes	PEM	Format of the certificate and private-key files.
				Options: PEM, DER
Password	string	Yes	—	Passphrase for PEM-formatted certificate and key files. Leave empty when the key is not encrypted. (shown when Certificate Format is PEM)
Notify When Expires	boolean	Yes	false	Whether to enable an alert when the certificate is about to expire.
Notification Period (Days)	number	Yes	10	Days before certificate expiry at which to generate an alert. Between 10 and 100. (shown when Notify When Expires is true)
Certificate Bundle	boolean	No	false	Whether to parse the certificate chain as a single file after linking the server certificate to its issuer. (shown when Certificate Format is PEM)

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	5	Maximum number of items to process concurrently. Keep low for appliance management APIs.

Output Data

Every operation merges its result onto the input item JSON — the incoming fields pass through unchanged — and produces one output item per input item. No operation fans out.

Resource / Operation	Fields merged onto the item	Binary
file / upload	success: true	The item’s binary is forwarded unchanged; nothing new is written.
file / download	filename, filelocation, fileSize (bytes)	The downloaded file is written to the named Binary Property, alongside any binary the item already carried. Its MIME type is detected from the file name and contents.
file / delete	success: true	Forwarded unchanged.
certificate / create	success: true	Forwarded unchanged.
certificate / install	success: true	Forwarded unchanged.

Only file / download returns detail; the other four confirm the call succeeded and rely on the Error output (or the workflow stopping) to signal failure. Reference the result downstream by expression, e.g. {{ $json.filename }} or {{ $json.success }}.

Usage Examples

• Download an SSL certificate from the ADC appliance
• Upload a PEM file to /nsconfig/ssl/
• Create a self-signed Root-CA certificate
• Install a certificate-key pair for SSL termination
• Delete an obsolete certificate file from the appliance

Example Configuration

Upload a file from an upstream node into the appliance’s SSL directory, renaming it:

{
  "type": "netscaler",
  "parameters": {
    "resource": "file",
    "operation": "upload",
    "fileLocation": "/nsconfig/ssl/",
    "binaryPropertyName": "fileData",
    "options": {
      "fileName": "server-cert.pem"
    },
    "maxConcurrency": 3
  }
}

Download a certificate file off the appliance into binary data:

{
  "type": "netscaler",
  "parameters": {
    "resource": "file",
    "operation": "download",
    "fileLocation": "/nsconfig/ssl/",
    "fileName": "{{ $json.certFile }}",
    "binaryPropertyName": "downloadedData",
    "maxConcurrency": 2
  }
}

Delete a superseded certificate file:

{
  "type": "netscaler",
  "parameters": {
    "resource": "file",
    "operation": "delete",
    "fileLocation": "/nsconfig/ssl/",
    "fileName": "old-cert.pem"
  }
}

Create a self-signed Root-CA certificate valid for ten years:

{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "create",
    "certificateType": "ROOT_CERT",
    "certificateFileName": "root-ca.pem",
    "certificateFormat": "PEM",
    "privateKeyFileName": "root-ca-key.pem",
    "certificateRequestFileName": "root-ca.csr",
    "additionalFields": {
      "days": "3650",
      "pempassphrase": "rootca123"
    }
  }
}

Create a CA-signed server certificate with subject alternative names:

{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "create",
    "certificateType": "SRVR_CERT",
    "certificateFileName": "server.pem",
    "certificateFormat": "PEM",
    "certificateRequestFileName": "server.csr",
    "caCertificateFileName": "ca-cert.pem",
    "caCertificateFileFormat": "PEM",
    "caPrivateKeyFileName": "ca-key.pem",
    "caPrivateKeyFileFormat": "PEM",
    "caSerialFileNumber": "ca-serial",
    "additionalFields": {
      "days": "365",
      "subjectaltname": "DNS:www.example.com,DNS:example.com"
    }
  }
}

Create an Intermediate-CA certificate signed by that root:

{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "create",
    "certificateType": "INTM_CERT",
    "certificateFileName": "intermediate-ca.pem",
    "certificateFormat": "PEM",
    "certificateRequestFileName": "intermediate-ca.csr",
    "caCertificateFileName": "internal-ca.pem",
    "caCertificateFileFormat": "PEM",
    "caPrivateKeyFileName": "internal-ca-key.pem",
    "caPrivateKeyFileFormat": "PEM",
    "caSerialFileNumber": "ca-serial.txt",
    "additionalFields": {
      "days": "3650"
    }
  }
}

Install a certificate-key pair for SSL termination, with an expiry alert:

{
  "type": "netscaler",
  "parameters": {
    "resource": "certificate",
    "operation": "install",
    "certificateKeyPairName": "web-server-ssl",
    "certificateFileName": "/nsconfig/ssl/server.pem",
    "privateKeyFileName": "/nsconfig/ssl/server-key.pem",
    "certificateFormat": "PEM",
    "password": "cert123",
    "notifyExpiration": true,
    "notificationPeriod": 30,
    "certificateBundle": true
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage SSL certificates and files on a Citrix ADC (NetScaler) appliance — upload, download, delete files and create/install certificates.

Behavior notes

• Certificate Type changes which fields you must fill. ROOT_CERT needs a private key file; the other three need the five CA fields instead. The editor hides the ones that do not apply, and the item fails if a required one is blank.
• Create needs a CSR. Both the certificate file name and the certificate request (CSR) file name are required for create, whichever type you pick.
• Install expects files already on the appliance. Upload the certificate and key with file / upload first, then reference their appliance paths in install.
• Notification Period only applies with Notify When Expires on, and the appliance accepts 10 to 100 days.
• Keep concurrency low. Appliance management APIs are not built for parallel load; the default of 5 is already generous for most appliances.

Common patterns

• SSL certificate lifecycle — upload the purchased certificate and key with file / upload, then bind them with certificate / install and switch on expiry notification.
• Internal CA management — create a Root-CA with ROOT_CERT, then create an Intermediate-CA with INTM_CERT that references the root’s files, and issue server certificates with SRVR_CERT.
• Certificate cleanup — remove expired files from /nsconfig/ssl/ with file / delete.