Enable NetScaler certificate validation in the NetScaler Ingress Controller

Last published : Nov 14, 2026
The NetScaler Ingress Controller provides an option to ensure secure communication between the NetScaler Ingress Controller and NetScaler by using the HTTPS protocol. You can achieve this by using pre-loaded certificates in the NetScaler. As an extra measure to avoid any possible man-in-the-middle (MITM) attack, the NetScaler Ingress Controller also allows you to validate the SSL server certificate provided by the NetScaler.
To enable certificate signature and common name validation of the ADC server certificate by the NetScaler Ingress Controller, security administrators can optionally install signed (or self-signed) certificates in the NetScaler and configure the NetScaler Ingress Controller with the corresponding CA certificate bundle. Once the validation is enabled and CA certificate bundles are configured, the NetScaler Ingress Controller starts validating the certificate (including certificate name validation). If the validation fails, the NetScaler Ingress Controller logs the same and none of the configurations are used on an unsecure channel.
This validation is turned off by default and an administrator can chose to enable the validation in the NetScaler Ingress Controller as follows.
Related information
Certificate management

Prerequisites

  • For enabling certificate validation, you must configure a NetScaler with proper SSL server certificates (with proper server name or IP address in certificate subject). For more information, see NetScaler documentation.
  • The CA certificate for the installed server certificate-key pair is used to configure the NetScaler Ingress Controller to enable validation of these certificates.

Configure the NetScaler Ingress Controller for certificate validation

To make a CA certificate available for configuration, you need to configure the CA certificate as a Kubernetes secret so that the NetScaler Ingress Controller can access it on a mounted storage volume.
To generate a Kubernetes secret for an existing certificate, use the following kubectl command:
  $ kubectl create secret generic ciccacert --from-file=path/myCA.pem –namespace default

  secret “ciccacert” created
Alternatively, you can also generate the Kubernetes secret using the following YAML definition:
apiVersion: v1
kind: Secret
metadata:
  name: ciccacert
  data:
    myCA.pem: <base64 encoded cert>
The following is a sample YAML file with the NetScaler Ingress Controller configuration for enabling certificate validation.
kind: Pod
metadata:
  name: cic
  labels:
    app: cic
spec:
  serviceAccountName: cpx
  # Make secret available as a volume
  volumes:
  - name: certs
    secret:
      secretName: ciccacert
  containers:
  - name: cic
    image: "xxxx"
    imagePullPolicy: Always
    args: []
    # Mounting certs in a volume path
    volumeMounts:
    - name: certs
      mountPath: <Path to mount the certificate>
      readOnly: true
    env:
    # Set NetScaler Console Management IP
    - name: "NS_IP"
      value: "xx.xx.xx.xx"
    # Set port for Nitro
    - name: "NS_PORT"
      value: "xx"
    # Set Protocol for Nitro
    - name: "NS_PROTOCOL"
      # Enable HTTPS protocol for secure communication
      value: "HTTPS"
    # Set username for Nitro
    - name: "NS_USER"
      value: "nsroot"
    # Set user password for Nitro
    - name: "NS_PASSWORD"
      value: "nsroot"
    # Certificate validation configurations
    - name: "NS_VALIDATE_CERT"
      value: "yes"
    - name: "NS_CACERT_PATH"
      value: " <Mounted volume path>/myCA.pem"
As specified in the example YAML file, following are the specific changes required for enabling certificate validation in the NetScaler Ingress Controller.

Configure Kubernetes secret as a volume

  • Configure a volume section declared with secret as the source. Here, secretName should match the Kubernetes secret name created for the CA certificate.

Configure a volume mount location for the CA certificate

  • Configure a volumeMounts section with the same name as that of secretName in the volume section
  • Declare a mountPath directory to mount the CA certificate
  • Set the volume as ReadOnly

Configure secure communication

  • Set the environment variable NS_PROTOCOL as HTTPS
  • Set the environment variable NS_PORT as ADC HTTPS port

Enable and configure CA validation and certificate path

  • Set the environment variable NS_VALIDATE_CERT to yes. To keep certificate validation turned off on purpose, set it to insecure. The value no is deprecated. When validation is off, the controller logs a deprecation warning and raises a Pod warning event.
  • Set the environment variable NS_CACERT_PATH as the mount path (volumeMounts->mountPath)/PEM file name (used while creating the secret).

Keep certificate validation turned off

In NetScaler Ingress Controller 4.3.22, certificate validation is turned off by default, and this default is deprecated. While validation is off, NetScaler Ingress Controller logs a deprecation warning and raises a warning event on its pod. To keep validation turned off on purpose, set NS_VALIDATE_CERT to insecure.
env:
  - name: "NS_VALIDATE_CERT"
    value: "insecure"
The supported values are yes, insecure, and no, which is deprecated. Any other value, such as true, is logged as an error and does not turn validation on. The warning and the pod event are also raised when the value is insecure.
If NS_VALIDATE_CERT is yes and NS_CACERT_PATH is empty, NetScaler Ingress Controller validates the NetScaler certificate against the public CA certificates that are bundled in its image. If NS_CACERT_PATH names a file that does not exist, NetScaler Ingress Controller exits at startup.

Configure certificate validation with the Helm chart

With the netscaler-ingress-controller Helm chart, use Helm values instead of the environment variables. Create a secret that holds the CA certificate under the nsCA.pem key:
kubectl create secret generic nscacert --from-file=nsCA.pem=<path-to-CA-certificate> -n <namespace>
Then, set nsValidateCert, nsCertSecret, and hostAlias values. Set nsIP and hostAlias.hostName to the host name in the NetScaler certificate, and set hostAlias.ip to the NetScaler management IP address.
nsIP: <NetScaler-host-name>
nsValidateCert: true
nsCertSecret: nscacert
hostAlias:
  ip: <NetScaler-management-IP-address>
  hostName: <NetScaler-host-name>
To keep validation turned off on purpose, leave nsValidateCert set to false and set the environment variable through extraEnv. The netscaler-gslb-controller and netscaler-kubernetes-gateway-controller charts accept the same extraEnv value.
extraEnv:
  - name: NS_VALIDATE_CERT
    value: "insecure"

Certificate validation for the metrics exporter

Starting with NetScaler Ingress Controller 4.3.22, if you run the metrics exporter (exporter.required: true) and nsValidateCert is false, you must set exporter.validateCert. Otherwise, helm install and helm upgrade fail. The setting takes effect with metrics exporter 1.7.0 or later.
exporter:
  required: true
  validateCert: auto
Value Behavior
auto, yes, true, y, on, 1 The exporter validates the NetScaler certificate against the CA certificates in the exporter image.
no, false, n, off, 0 The exporter does not validate the NetScaler certificate.
When nsValidateCert is true, the exporter validates the NetScaler certificate against the CA certificate in nsCertSecret, and exporter.validateCert is ignored.