Manage SSL certificates from the certificate store using StyleBooks
NetScaler ADM certificate store helps you to store and manage your SSL certificates in one location. So, you can store SSL certificates in NetScaler ADM and reuse them during ADC configuration.
This article describes how to create a StyleBook definition that allows you to upload and reuse SSL certificates from the NetScaler ADM certificate store.
The StyleBook definition supports
certkey as a new built-in parameter type. Use this parameter type to reuse SSL certificates from the NetScaler ADM certificate store.
parameters: - name: certificate label: Certificate description: "Certificate to be bound to this virtual load balanced application" type: certkey required: true <!--NeedCopy-->
In this example, the certificate parameter refers to an SSL certificate or certificate chain from the NetScaler ADM certificate store.
In the StyleBook definition, you can refer to the following properties for a
certkeyname– A name of SSL certificate key that you want to configure on an instance.
cert_filename– The file name of an SSL certificate.
password– The password required to access an SSL certificate if necessary.
key_filename– The file name of an SSL certificate key.
keyfile_contents– The file contents of an SSL certificate.
subject– Subject mentioned in an SSL certificate.
issuer– It refers to an authority who issued the SSL certificate.
certchain_certkeyname– Sometimes, server certificates are signed by multiple hierarchical Certificate Authorities (CA), which means that the certificates form a chain.
Use this property when the certificate store has a certificate chain. It helps you refer and bind the certificates together. While you create a configuration pack, the certificate chain appears as list.
These properties help you create the required components in the StyleBook definition.
When a StyleBook has a
type: certkey parameter, the StyleBook user can provide a certificate for this parameter from the NetScaler ADM certificate store. In this workflow, along with viewing and selecting certificates from NetScaler ADM certificate store, users can also do the following:
- Upload new certificates.
- Update existing certificates. For example, expired certificates.
- Remove certificates.
You can also manage certificates in NetScaler ADM certificate store using NetScaler ADM SSL Dashboard.
When an SSL certificate is updated in the NetScaler ADM certificate store, the configuration packs associated with the SSL certificate are automatically updated.
Build your StyleBook
The following is an example StyleBook definition. It is a complete definition that uses SSL certificates from the NetScaler ADM certificate store. This StyleBook includes components that upload the main certificate and key files to the ADC instance. If these files are already present on the ADC instance, NetScaler ADM skips the uploading steps, and these components have no effect.
name: lb-with-cert-from-certstore namespace: com.example.stylebooks version: "1.0" display-name: Application using a CertStore certificate description: This StyleBook defines a simple SSL Vserver. schema-version: "1.0" import-stylebooks: - namespace: netscaler.nitro.config version: "13.0" prefix: ns parameters: - name: name type: string label: Application Name description: Give a name to the application configuration. required: true - name: ip type: ipaddress label: Application Virtual IP (VIP) description: The Application VIP that clients access required: true - name: certificate label: Application Certificate description: Certificate chain and key to be bound to this application type: certkey required: true components: - name: pem-cert-files-comp type: ns::systemfile description: This component uploads the PEM certificate file onto the NetScaler condition: $parameters.certificate properties: filename: $parameters.certificate.cert_filename filelocation: /nsconfig/ssl filecontent: base64($parameters.certificate.certfile_contents) fileencoding: BASE64 - name: pem-KEY-files-comp type: ns::systemfile description: This component uploads the PEM key file onto the NetScaler. condition: $parameters.certificate properties: filename: $parameters.certificate.key_filename filelocation: /nsconfig/ssl filecontent: base64($parameters.certificate.keyfile_contents) fileencoding: BASE64 - name: cert-files-comp type: ns::sslcertkey description: This component creates the certkey on the ADC using the uploaded files. condition: $parameters.certificate properties: certkey: $parameters.certificate.certkeyname cert: $parameters.certificate.cert_filename key: $parameters.certificate.key_filename - name: lbvserver-comp type: ns::lbvserver description: This component creates the lbvserver of the application. properties: name: $parameters.name + "-lbvserver" servicetype: SSL ipv46: $parameters.ip port: 443 lbmethod: ROUNDROBIN components: - name: sslvserver-comp type: ns::sslvserver description: This component configures SSL settings on the vserver properties: vservername: $parent.properties.name ssl3?: ENABLED tls1?: ENABLED tls11?: ENABLED - name: cert-bindings-adv-comp type: ns::sslvserver_sslcertkey_binding description: This component binds the certkey to the vserver condition: $parameters.certificate properties: vservername: $parent.properties.name certkeyname: $parameters.certificate.certkeyname <!--NeedCopy-->