Update Adaptive Authentication certificate

We recommend you to upload the new or updated certificate from Upload Certificate tab in the Adaptive Authentication service portal. The certificate uploaded from this portal is saved with the default name “tenant-id.pfx” in the /nsconfig/ssl/ folder. An SSL cert key is automatically created, pointing to this certificate, with the name “[tenant-id]-certkey”. The default bind points (auth_vs and VPN global) are also automatically updated with the new cert key.

You must not use this cert key for any other purposes, such as Security Assertion Markup Language (SAML) or Load Balancing (LB). If the cert key is used outside the default bind points (auth_vs and VPN global), you might encounter the “failed to update certkey” error while uploading the certificate from the Adaptive Authentication service portal.

Cert key error

To resolve this error, you must manually remove the cert key from other bind points and re-upload the certificate.

Following are the sample steps to resolve the error when the cert key is used with LB virtual server:

  1. Identify all the bind points where the cert key “[tenant-id]-certkey” is being used, if not already known.

    • Log in to the primary node of NetScaler® by using Secure Shell (SSH) and run the following command:
    sh runn | grep [tenant-id]-certkey
    <!--NeedCopy-->
    

    In the following image, in addition to the default bind points (auth_vs and VPN global), the cert key is also bound to the LB virtual server.

    Certkey error

  2. Unbind the cert key from the LB virtual server. For more information, see Unbind an SSL certificate-key pair from a virtual server by using the CLI.

  3. Re-upload the certificate from the Adaptive Authentication service portal. For more information, see Upload Certificate.

    Cert key error

  4. Re-bind the new cert key (with the same name “[tenant-id]-certkey”) to the LB virtual server. For more information, see Bind the certificate-key pair to the SSL virtual server.

Update Adaptive Authentication certificate

In this article