Cause:

Certificate integrity checks may behave incorrectly when the certificate or SSL file names contain spaces.

During the validation process, the integrity check does not correctly handle file names that include spaces. As a result, the validation logic fails to obtain the complete file name and incorrectly determines that the associated certificate or key file is missing.

This leads to unexpected certificate integrity validation failures even though the certificate and key are valid and correctly configured.

Example:

The following SSL file names can trigger the issue because they contain spaces, and the integrity check may incorrectly process the file path and generate a validation error.

• my certificate.pem
• web server cert.crt
• production key.pem

Best Practice:

When creating or importing SSL certificates and keys, use SSL file names that are unique, meaning no other files in the Netscaler have the same name and that only contain:

• Letters (A–Z, a–z)
• Numbers (0–9)
• Hyphens (-)
• Underscores (_)

The above mentioned sample code is provided to you as is with no representations, warranties or conditions of any kind. You may use, modify and distribute it at your own risk. CITRIX DISCLAIMS ALL WARRANTIES WHATSOEVER, EXPRESS, IMPLIED, WRITTEN, ORAL OR STATUTORY, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT. Without limiting the generality of the foregoing, you acknowledge and agree that (a) the sample code may exhibit errors, design flaws or other problems, possibly resulting in loss of data or damage to property; (b) it may not be possible to make the sample code fully functional; and (c) Citrix may, without notice or liability to you, cease to make available the current version and/or any future versions of the sample code. In no event should the code be used to support ultra-hazardous activities, including but not limited to life support or blasting activities. NEITHER CITRIX NOR ITS AFFILIATES OR AGENTS WILL BE LIABLE, UNDER BREACH OF CONTRACT OR ANY OTHER THEORY OF LIABILITY, FOR ANY DAMAGES WHATSOEVER ARISING FROM USE OF THE SAMPLE CODE, INCLUDING WITHOUT LIMITATION DIRECT, SPECIAL, INCIDENTAL, PUNITIVE, CONSEQUENTIAL OR OTHER DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Although the copyright in the code belongs to Citrix, any distribution of the sample code should include only your own standard copyright attribution, and not that of Citrix. You agree to indemnify and defend Citrix against any and all claims arising from your use, modification or distribution of the sample code.

A permanent fix has been planned for a future release by the engineering team. Until the fix becomes available, Citrix recommends ensuring that the CertKey and SSL file names do not contain spaces before upgrading the Netscaler.

Workaround 1

Complete the upgrade through the Netscaler CLI.

The upgrade script will prompt an error about the Certificate Digest, but it also provides the option to bypass the validation; the administrator will be asked a Y/N question to continue.

Workaround 2

1. Rename the CertKey and SSL files, ensuring that they do not contain any spaces. For example:
   • my certificate.pem   ----->> my_certificate.pem
   • production key.pem ----->> production_key.pem
2. Reinstall or update the CertKey using the renamed SSL Files.
   • We need to ensure the command line reflects the new names
   • Review the certificate links and bindings as needed.
3. Rerun the pre-upgrade validation.

When performing a NetScaler/ADC upgrade, the pre-upgrade validation process may fail even though the configured SSL certificates and private keys are valid.

Administrators may observe one or more of the following:

• Pre-upgrade validation reports certificate or key integrity failures.
• Upgrade readiness checks do not complete successfully.
• Certificates or keys are incorrectly reported as missing.
• The appliance upgrade is blocked due to failed validation checks.

This issue has been reported by multiple administrators and has been reproduced internally. The validation failure occurs despite the certificate and key being properly installed and functioning normally.

The issue affects the pre-upgrade certificate integrity validation process only. SSL certificates and keys may continue to function normally in production traffic handling; however, upgrades can be blocked when validation incorrectly reports the files as missing.