Creating Self-signed Certificates for NetScaler Gateway | Getting Started with XenDesktop 7.x

Testing the NetScaler Gateway^™ connection

Once you have NetScaler Gateway built and configured, you need to test it. For it to work properly, the certificates must be valid. If you remember, we just created the self-signed test certificates. We now need to download these test certificates from NetScaler and import them into our client device.

Testing NetScaler Gateway^™ with a Windows client

One quick way to test if the certificate chain is working on NetScaler is by downloading the root CA certificate, self-signing the public-facing server certificate from NetScaler, and importing these into the client browser. The following steps will guide you through how to test NetScaler Gateway with a Windows client:

Download the test certificate from NetScaler Gateway. You can do this using a secure FTP client such as WinSCP.net.
Download and install WinSCP from http://winscp.net.
Launch WinSCP and log in to NetScaler Gateway through the NetScaler IP Address (NSIP). Navigate to the /nsconfig/ssl directory and copy the .cer, .req, and .key files, as shown in the following screenshot.
Note
You will need the NetScaler username and password to connect.
To launch Microsoft Management Console (MMC) from the Start menu, right-click and then choose Run. Then, enter MMC, as shown in the following screenshot:
Load Certificates snap-in for Computer account, as shown in the following screenshot:
Expand the Trusted Root Certification Authorities tab and select Certificates, as shown in the following screenshot:
Navigate to Action | All Tasks | Import. This launches the Certificate Import Wizard window. Select Local Machine and then click on Next, as shown in the following screenshot:
Browse for the self-signed root CA certificate. Open it and then click on Next, as shown in the following screenshot:
Install it in the Trusted Root Certification Authorities store. Click on Next and then click on Finish, as shown in the following screenshot:
Navigate to Personal | Certificates, as shown in the following screenshot:
Navigate to Action | All Tasks | Import. This launches the Certificate Import Wizard window. Select Local Machine and then click on Next, as shown in the following screenshot:
Browse for the self-signed public server certificate. Open it and then click on Next, as shown in the following screenshot:
Install it in the Personal store. Click on Next and then on Finish, as shown in the following screenshot:
Launch a browser and connect to NetScaler Gateway using the entry that you have placed in the hosts file, for example, ng.xenpipe.com. You should be able to see the Citrix Receiver logon screen without any certificate issues. Select Desktops to launch a virtual desktop. Select Apps to launch a virtual application (you can also launch these apps from your virtual desktop), as shown in the following screenshot.
Note
Keep in mind that the URL that you connect to and the entry in the hosts file must also match the Common Name field in the certificate for it to work. Because we created a wildcard certificate, *.xenpipe.com, the NetScaler Gateway URL, https://ng.xenpipe.com, will work as would any https://<sub-domain>.xenpipe.com.