You can use the SSL certificate dashboard in NetScaler MAS to view graphs that help you keep track of certificate issuers, key strengths, and signature algorithms. The SSL certificate dashboard also displays graphs that indicate the following:
- Number of days after which certificates expire
- Number of used and unused certificates
- Number of self-signed and CA-signed certificates
- Number of issuers
- Signature algorithms
- SSL protocols
- Top 10 instances by number of certificates in use
This document includes the following information:
To monitor SSL certificates
You may use the SSL dashboard on NetScaler MAS to monitor your certificates if your company has SSL Policy where you have defined certain SSL certificate requirements such as all certificates must have minimum key strengths of 2048 bits and a trusted CA authority must authorize it.
In another example, you may have uploaded a new certificate but forgotten to bind it to a virtual server. The SSL dashboard highlights the SSL certificates being used or not used. In the Usage section, you can see the number of certificates that have been installed, and the number of certificates being used. You can further click on the graph, to see the certificates name, the instance on which it’s being used, its validity, its signature algorithm, and so on.
To monitor SSL certificates in NetScaler MAS, navigate to Networks > SSL Dashboard.
NetScaler MAS allows you to poll SSL Certificates and add all the SSL certificates of the instances immediately to NetScaler MAS. To do so, navigate to Networks > SSL Dashboard and click Poll Now. The Poll Now page pops up, presenting the option to poll all NetScaler instances in the network or poll selected instances.
You can use the NetScaler MAS SSL dashboard to view or monitor the details of NetScaler SSL certificates, SSL Virtual Servers, and SSL protocols. "Total" numbers are hyperlinks, which you can click to display details related to SSL certificates, SSL Virtual Servers, or SSL protocols.
For example, when a user clicks the number 12 under "Self signed vs. CA signed" in the above figure, a new window appears, showing details of the 12 SSL certificates on the NetScaler instances.
The NetScaler MAS SSL Dashboard also shows the distribution of SSL protocols that are running on your virtual servers. As an administrator, you can specify the protocols that you want to monitor through the SSL policy, for more information, see Configuring SSL Policies. The protocols supported are SSLv2, SSLv3, TLS1.0, TLS1.1, and TLS1.2. The SSL protocols used on virtual servers appear in a bar chart format. Clicking on a specific protocol displays a list of virtual servers using that protocol.
A donut chart appears after Diffie-Hellman (DH) or Ephermeral RSA keys are enabled or disabled on the SSL dashboard. These keys enable secure communication with export clients even if the server certificate does not support export clients, as in the case of a 1024-bit certificate. Clicking on the appropriate chart displays a list of the virtual servers on which DH or Ephemeral RSA keys are enabled.
To view audit trails for SSL certificates
You can now view log details of SSL certificates on NetScaler MAS. The log details display operations performed using SSL certificates on NetScaler MAS such as: installing SSL certificates, linking and unlinking SSL certificates, updating SSL certificates, and deleting SSL certificates. Audit trail information is useful while monitoring SSL certificate changes done on an application with multiple owners.
To view an audit log for a particular operation performed on NetScaler MAS using SSL certificates, navigate to Networks > SSL Dashboard > SSL Audit Trails.
For a particular operation performed using SSL certificate you can view its status, start time, and end time. Furthermore, you can view the instance on which the operation was performed and the commands executed on that instance.
To exclude default NetScaler certificates on the SSL Dashboard
NetScaler MA allows you to show or hide default NetScaler certificates showing up on the SSL Dashboard charts based on your preferences. By default, all certificates are displayed on the SSL dashboard including default certificates.
To show or hide default certificates on the SSL dashboard:
1. Navigate to Networks > SSL Dashboard in the NetScaler MAS GUI.
2. On SSL Dashboard page, click Settings.
3. On the Settings page, click the edit icon.
4. In Certificate Filter Settings section, clear the Show Default Certificates check box and click Save.