diff --git a/Images/CertStore.gif b/Images/CertStore.gif deleted file mode 100644 index 956aa8d..0000000 Binary files a/Images/CertStore.gif and /dev/null differ diff --git a/Images/CertStoreTypeSettings.gif b/Images/CertStoreTypeSettings.gif deleted file mode 100644 index dd45a8f..0000000 Binary files a/Images/CertStoreTypeSettings.gif and /dev/null differ diff --git a/Images/TC1.gif b/Images/TC1.gif deleted file mode 100644 index 50e23b7..0000000 Binary files a/Images/TC1.gif and /dev/null differ diff --git a/Images/TC10.gif b/Images/TC10.gif deleted file mode 100644 index 2e996db..0000000 Binary files a/Images/TC10.gif and /dev/null differ diff --git a/Images/TC11.gif b/Images/TC11.gif deleted file mode 100644 index 5d75d20..0000000 Binary files a/Images/TC11.gif and /dev/null differ diff --git a/Images/TC12.gif b/Images/TC12.gif deleted file mode 100644 index 6e6fc5d..0000000 Binary files a/Images/TC12.gif and /dev/null differ diff --git a/Images/TC13.gif b/Images/TC13.gif deleted file mode 100644 index cd28917..0000000 Binary files a/Images/TC13.gif and /dev/null differ diff --git a/Images/TC14.gif b/Images/TC14.gif deleted file mode 100644 index 9d84a13..0000000 Binary files a/Images/TC14.gif and /dev/null differ diff --git a/Images/TC2.gif b/Images/TC2.gif deleted file mode 100644 index 97e46da..0000000 Binary files a/Images/TC2.gif and /dev/null differ diff --git a/Images/TC3.gif b/Images/TC3.gif deleted file mode 100644 index 892ad1f..0000000 Binary files a/Images/TC3.gif and /dev/null differ diff --git a/Images/TC4.gif b/Images/TC4.gif deleted file mode 100644 index 89d885f..0000000 Binary files a/Images/TC4.gif and /dev/null differ diff --git a/Images/TC5.gif b/Images/TC5.gif deleted file mode 100644 index 9c911f1..0000000 Binary files a/Images/TC5.gif and /dev/null differ diff --git a/Images/TC6.gif b/Images/TC6.gif deleted file mode 100644 index bb90bed..0000000 Binary files a/Images/TC6.gif and /dev/null differ diff --git a/Images/TC7.gif b/Images/TC7.gif deleted file mode 100644 index e2e484f..0000000 Binary files a/Images/TC7.gif and /dev/null differ diff --git a/Images/TC8.gif b/Images/TC8.gif deleted file mode 100644 index 72b37f8..0000000 Binary files a/Images/TC8.gif and /dev/null differ diff --git a/Images/TC9.gif b/Images/TC9.gif deleted file mode 100644 index e7ac907..0000000 Binary files a/Images/TC9.gif and /dev/null differ diff --git a/readme_source.md b/readme_source.md deleted file mode 100644 index 8d49e84..0000000 --- a/readme_source.md +++ /dev/null @@ -1,150 +0,0 @@ -# Citrix ADC Orchestrator Configuration -## Overview - -The Citrix ADC Orchestrator remotely manages certificate objects on the NetScaler device. Since the ADC supports services including: -Load Balancing, Authentication/Authorization/Auditing (AAA), and Gateways, this orchestrator can bind to any of these virtual servers when using unique virtual server names for each service. - -### Permissions - -The NetScaler user needs permission to perform the following API calls: - -API Endpoint|Methods ----|--- -/nitro/v1/config/login|post -/nitro/v1/config/lbvserver| get -/nitro/v1/config/sslcertkey| get, update, add, delete -/nitro/v1/config/sslcertkey_service_binding| get, update, add, delete -/nitro/v1/config/systemfile| get, add, delete - -Here is a sample policy with Min Permissions: -* Action: -Allow -* Command Spec: -(^stat\s+(cr|cs|lb|system|vpn))|(^(add|rm|show)\s+system\s+file\s+.*)|(^\S+\s+ssl\s+.*)|(^(show|stat|sync)\s+HA\s+.*)|(^save\s+ns\s+config)|(^(switch|show)\s+ns\s+partition.*) - - -### Upgrade Procedures - -* Upgrade From v1.0.2 to v2.0.0 - * In the Keyfactor Command Database, run the following SQL Script to update the store types and store information [Upgrade Script](https://github.com/Keyfactor/citrix-adc-orchestrator/blob/snipamupdates/UpgradeScript.sql) - -### Below are specific notes and limitations -* As of release 2.2.0, ONLY certificate objects (installed certificates) will be managed by the Citrix ADC Orchestrator Extension. Prior versions also managed certificate/key file combinations uploaded to the Citrix ADC device but not yet installed. This functionality has been removed due to issues attempting to match certificate and key files due to inconsistent file naming. - -* Direct PFX Binding Inventory - * In NetScaler you can directly Bind a Pfx file to a Virtual Server. Keyfactor cannot inventory these because it does not have access to the password. The recommended way to Import PFX Files in NetScaler is descibed in this [NetScaler Documentation](https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/ssl-certificates/export-existing-certs-keys.html#convert-ssl-certificates-for-import-or-export) - -* Specifiy Multiple VServers and Sni Flags - * When Binding to Multiple VServers and using Multiple SniFlags, you must use a comma separated list of values as described in Test Case 13 in the Test Cases Section. This will change in future version, so each binding is a store in Keyfactor. - -* Down Time When Replacing Certs - * The orchestrator uses [NetScaler recommended methods](https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/ssl-certificates/add-group-certs.html) to replace bound certs which creates a sub second blip of downtime. There is currently no way around this if you want readable keypair names. - -* Removing Certs from Store - * As defined in Test Cases 5 and 13 below, certificates that are bound to a server will not be removed. This was done to limit the possibility of bringing production servers down. Users are currently required to manually unbind the certificate from the server and then remove the cert using Command. This requirement may change in a future version. - -* Renewals - * The renewal process will find the thumbprint of the cert on all VServers and renew them in all places. See test cases #6 and #10 in the Test Cases section. Note, as of release 2.2.0, this will no longer be the case. Certificates (certificate objects) will be renewed based on the supplied alias only. Only the underlying system files attached to the provided alias will be replaced. - -* AutoSave Config - * A new config.json file in the extension folder contains the 'AutoSaveConfig' flag with a default value of 'N'. When this flag is set to 'Y', successful configuration changes made by a management job will be automatically saved to disk; no interaction with the Citrix ADC UI is necessary. - - **NOTE:** Any changes in-process through the Citrix ADC UI will also be persisted to disk when a management job is performed and the AutoSaveConfig flag is set to 'Y'. - -* Support for Virtual Authentication Servers & Gateways - * When performing management operations to either of services, Users may enter the specific VServer name to complete the operation. - - **NOTE:** If multiple VServers share the same Alias, all VServers that share that alias will be updated. - -* Supports optional linking of added certificates to issuing CA certificate if issuing CA is already installed in the managed Netscaler instance. - -
- Cert Store Type Settings -
- -![](Images/CertStoreTypeSettings.gif) - -**Basic Settings** - -CONFIG ELEMENT | VALUE | DESCRIPTION -------------------|------------------|---------------- -Name |Citrix ADC |A descriptive name for the extension. Example: CitrixAdc -Short Name|CitrixADC|The short name that identifies the registered functionality of the orchestrator. Must be CitrixAdc. -Custom Capability|Unchecked|Store type name orchestrator will register with. -Supported Job Types|Inventory, Add, Remove |Job types this extension supports -Needs Server | Checked | Determines if a target server name is required when creating store -Blueprint Allowed | Unchecked | Determines if store type may be included in an Orchestrator blueprint -Uses PowerShell | Unchecked | Determines if underlying implementation is PowerShell -Requires Store Password|Unchecked |Determines if a store password is required when configuring an individual store. -Supports Entry Password|Unchecked |Determined if an individual entry within a store can have a password. - -**Advanced Settings** - -CONFIG ELEMENT | VALUE | DESCRIPTION -------------------|------------------|---------------- -Store Path Type |Freeform |Determines what restrictions are applied to the store path field when configuring a new store. -Supports Custom Alias |Required |Determines if an individual entry within a store can have a custom Alias. -Private Keys |Required |This determines if Keyfactor can send the private key associated with a certificate to the store. This is required since Citrix ADC will need the private key material to establish TLS connections. -PFX Password Style |Default or Custom |This determines how the platform generate passwords to protect a PFX enrollment job that is delivered to the store. - -**Custom Fields** - -Name|Display Name|Type|Default Value|Required|Description ----|---|---|---|---|--- -ServerUsername|Server Username|Secret||No|The username to log into the Server -ServerPassword|Server Password|Secret||No|The password that matches the username to log into the Server -ServerUseSsl|Use SSL|Bool|True|Yes|Determine whether the server uses SSL or not -linkToIssuer|Link To Issuer|Bool|False|False|Determines whether attempt will be made to link certificate added via a Management-Add job to its issuing CA certificate - -**Entry Parameters** - -Name|Display Name|Type|Default Value|Required|Description ----|---|---|---|---|--- -virtualServerName|Virtual Server Name|String| |Leave All Unchecked|When Enrolling, this can be a single or comma separated list of VServers in NetScaler to replace.
**NOTE:** When adding multiple VServers, each certificate will contain the same alias name. -sniCert|SNI Cert|String|false - - -
- -
- Cert Store Setup -
- -![](Images/CertStore.gif) - -#### STORE CONFIG -CONFIG ELEMENT | DESCRIPTION -------------------|------------------ -Client Machine | This is the IP Address of the NetScaler Appliance. -Store Path| This is the path of the NetScaler Appliance. /nsconfig/ssl/. -User| This is the user that will be authenticated against the NetScaler Appliance -Password| This is the password that will be authenticated against the NetScaler Appliance -Use SSL| This should be set to True in Production when there is a valid certificate. -Inventory Schedule| Set this for the appropriate inventory interval needed. - -
- - - -
- Test Cases -
- -Case Number|Case Name|Enrollment Params|Expected Results|Passed|Screenshot -----|------------------------|------------------------------------|--------------|----------------|------------------------- -1 |Add Unbound Cert|**Alias:** TC1.boingy.com
**Virtual Server Name:**
**Sni Cert:** false|Adds New Unbound Cert To Citrix ADC|True|![](Images/TC1.gif) -2 |Remove Unbound Cert|**Alias:** TC1.boingy.com
**Virtual Server Name:**
**Sni Cert:** false|Removes Unbound Cert From Citrix ADC|True|![](Images/TC2.gif) -3 |Add Bound Cert|**Alias:** TC3.boingy.com
**Virtual Server Name:** TestVServer
**Sni Cert:** false|Adds a new bound cert to TestVServer Virtual Server|True|![](Images/TC3.gif) -4 |Add Bound Cert Multiple VServers|**Alias:** TC4.boingy.com
**Virtual Server Name:** TestVServer,TestVServer2
**Sni Cert:** false,false|Adds New Bound Cert To Both Servers in Citrix|True|![](Images/TC4.gif) -5 |Remove Bound Cert|**Alias:** TC4.boingy.com
**Virtual Server Name:**
**Sni Cert:** false|Will Not Remove because it is bound. Must Unbind it First|True|![](Images/TC5.gif) -6 |Renew Bound Cert|**Alias:** TC4.boingy.com
**Virtual Server Name:**
**Sni Cert:** false|Renews Bound Cert on Both VServers|True|![](Images/TC6.gif) -7 |Replace Bound Cert No Overwrite |**Alias:** TC4.boingy.com
**Virtual Server Name:** TestVServer,TestVServer2
**Sni Cert:** false,false|Will Not replace, overwrite flag needed|True|![](Images/TC7.gif) -8 |Replace Bound Cert with Overwrite|**Alias:** 16934
**Virtual Server Name:**
**Sni Cert:** false|Will do the replace because overwrite was used|True|![](Images/TC8.gif) -9 |Add Sni Cert and Bind|**Alias:** TC9.boingy.com
**Virtual Server Name:** TestVServer
**Sni Cert:** false|Will bind an additional SNI Cert to a VServer|True|![](Images/TC9.gif) -10 |Renew bound Sni Cert|**Alias:** TC10.boingy.com
**Virtual Server Name:**
**Sni Cert:** false|Will Renew the Sni Cert Bound to the Site|True|![](Images/TC10.gif) -11 |Replace bound Sni Cert with Overwrite|**Alias:** TC9.boingy.com
**Virtual Server Name:** TestVServer
**Sni Cert:** true|Sni Cert Will Be Replaced and bound|True|![](Images/TC11.gif) -12 |Remove Bound Sni Cert|**Alias:** TC9.boingy.com
**Virtual Server Name:**
**Sni Cert:** false|Will Not Remove because it is bound. Must Unbind it First|True|![](Images/TC12.gif) -13 |Add Sni Cert To Multiple VServers and bind|**Alias:** TC13.boingy.com
**Virtual Server Name:** TestVServer,TestVServer2
**Sni Cert:** false,true|Adds and binds Cert to TestVServer and adds and binds Sni Cert to TestVServer2|True|![](Images/TC13.gif) -14 |Inventory |No Params|Will Perform Inventory and pull down all Certs Tied to VServers|True|![](Images/TC14.gif) - -