docs/documentation/platform/pki/applications/certificate-syncs/netscaler.mdx
Deploy certificates to Citrix NetScaler ADC appliances via the NITRO API. Certificates can be automatically bound to SSL virtual servers for seamless load balancer integration.
<Info> Certificate Syncs are configured per Application. First select which certificates to sync, then configure the NetScaler destination. </Info> 2. Select the **NetScaler** option.
3. Configure the **Destination**:
- **NetScaler Connection**: The NetScaler Connection to authenticate with.
- **SSL vServer Name** (Optional): The SSL virtual server to bind the certificate to. Leave empty to only upload without binding.
4. Configure the **Sync Options**:
- **Enable Removal of Expired/Revoked Certificates**: Remove certificates from the destination if they are no longer active.
- **Preserve Certificate on Renewal**: Update the existing certkey object in place, preserving name and vServer bindings.
- **Certificate Name Schema**: Customize certificate names using `{{certificateId}}` placeholder.
- **Auto-Sync Enabled**: Automatically sync certificates when changes occur.
5. Configure the **Details**:
- **Name**: The name of your sync (slug-friendly).
- **Description**: Optional description.
6. Select which certificates should be synced.
7. Review and click **Create Sync**.
</Tab>
<Tab title="API">
To create a **NetScaler Certificate Sync**, make an API request to the [Create NetScaler PKI Sync](/api-reference/endpoints/pki/syncs/netscaler/create) endpoint.
### Sample request
<Note>
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
If not provided, you can add certificates later using the certificate management endpoints.
</Note>
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/netscaler \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-netscaler-cert-sync",
"applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example certificate sync",
"connectionId": "550e8400-e29b-41d4-a716-446655440000",
"destination": "netscaler",
"isAutoSyncEnabled": true,
"certificateIds": [
"550e8400-e29b-41d4-a716-446655440000"
],
"syncOptions": {
"canRemoveCertificates": true,
"preserveItemOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"destinationConfig": {
"vserverName": "vs-ssl-prod"
}
}'
```
### Sample response
```json Response
{
"pkiSync": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-netscaler-cert-sync",
"description": "an example certificate sync",
"destination": "netscaler",
"isAutoSyncEnabled": true,
"destinationConfig": {
"vserverName": "vs-ssl-prod"
},
"syncOptions": {
"canRemoveCertificates": true,
"preserveItemOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "550e8400-e29b-41d4-a716-446655440000",
"createdAt": "2026-03-31T00:00:00.000Z",
"updatedAt": "2026-03-31T00:00:00.000Z"
}
}
```
</Tab>
The NetScaler Certificate Sync provides:
sslcertkey objects with customizable naming.When syncing certificates, Infisical performs the following steps on the NetScaler appliance via the NITRO REST API:
.cer) to /nsconfig/ssl/..key) to /nsconfig/ssl/.sslcertkey object linking the cert and key.When a certificate is renewed in Infisical, the behavior depends on the Preserve Certificate on Renewal option:
When certificate removal is enabled and a certificate is no longer active in Infisical:
sslcertkey object./nsconfig/ssl/.You can manually trigger certificate synchronization to NetScaler using the sync certificates functionality. This is useful for:
To manually sync certificates, use the Sync Certificates API endpoint or the manual sync option in the Infisical UI.