Cause:

Certificate integrity checks may behave incorrectly when the certificate or SSL file names contain spaces.

During the validation process, the integrity check does not correctly handle file names that include spaces. As a result, the validation logic fails to obtain the complete file name and incorrectly determines that the associated certificate or key file is missing.

This leads to unexpected certificate integrity validation failures even though the certificate and key are valid and correctly configured.

Example:

The following SSL file names can trigger the issue because they contain spaces, and the integrity check may incorrectly process the file path and generate a validation error.

• my certificate.pem
• web server cert.crt
• production key.pem

Best Practice:

When creating or importing SSL certificates and keys, use SSL file names that are unique, meaning no other files in the Netscaler have the same name and that only contain:

• Letters (A–Z, a–z)
• Numbers (0–9)
• Hyphens (-)
• Underscores (_)

A permanent fix has been planned for a future release by the engineering team. Until the fix becomes available, Citrix recommends ensuring that the CertKey and SSL file names do not contain spaces before upgrading the Netscaler.

Workaround 1

Complete the upgrade through the Netscaler CLI.

The upgrade script will prompt an error about the Certificate Digest, but it also provides the option to bypass the validation; the administrator will be asked a Y/N question to continue.

Workaround 2

1. Rename the CertKey and SSL files, ensuring that they do not contain any spaces. For example:
   • my certificate.pem   ----->> my_certificate.pem
   • production key.pem ----->> production_key.pem
2. Reinstall or update the CertKey using the renamed SSL Files.
   • We need to ensure the command line reflects the new names
   • Review the certificate links and bindings as needed.
3. Rerun the pre-upgrade validation.

When performing a NetScaler/ADC upgrade, the pre-upgrade validation process may fail even though the configured SSL certificates and private keys are valid.

Administrators may observe one or more of the following:

• Pre-upgrade validation reports certificate or key integrity failures.
• Upgrade readiness checks do not complete successfully.
• Certificates or keys are incorrectly reported as missing.
• The appliance upgrade is blocked due to failed validation checks.

This issue has been reported by multiple administrators and has been reproduced internally. The validation failure occurs despite the certificate and key being properly installed and functioning normally.

The issue affects the pre-upgrade certificate integrity validation process only. SSL certificates and keys may continue to function normally in production traffic handling; however, upgrades can be blocked when validation incorrectly reports the files as missing.