How to Generate a CSR on Citrix Access Gateway 5.0 (Legacy)

This tutorial shows you how to generate a CSR (Certificate Signing Request) on Citrix Access Gateway 5.0 using the Access Gateway Management Console.

Important: Citrix Access Gateway 5.0 is end of life. Citrix retired the standalone Access Gateway line years ago, and remote-access workloads now run on NetScaler Gateway (previously branded Citrix Gateway, and part of the NetScaler platform under Cloud Software Group since October 2022). If you are deploying or migrating to a supported platform, follow our companion guide on how to generate a CSR on NetScaler instead. The steps below are kept for administrators who still maintain a legacy CAG 5.0 appliance and need to renew its certificate.

Generate a CSR on Citrix Access Gateway 5.0

If you have already generated your CSR and received the issued certificate from your CA, skip ahead to installing the certificate on Citrix Access Gateway 5.0.

You can create the CSR two ways: on the appliance with the built-in wizard (covered below), which keeps the private key on the appliance, or off-box with our CSR Generator, which produces the CSR and the matching private key for you to import later. Save that key safely, because you will need it when the certificate is installed. The on-appliance steps follow.

Step 1: Open the certificate request wizard

• Log in to the Access Gateway Management Console and click Certificates.
• In the right-hand pane, click New to open the Certificate Signing Request tab.

Step 2: Fill in the CSR fields

Use standard ASCII characters in every field. Accented or non-Latin letters can break the request. Complete the form as follows:

• Key length: select the 2048-bit option. 2048-bit RSA is the minimum every public CA accepts and the right choice on this appliance.
• Common Name: the fully qualified domain name (FQDN) you want to secure, for example yoursite.com. For a wildcard certificate, put an asterisk in front of the domain, for example *.yoursite.com.
• Email: a valid email address. Public CAs no longer use this field to validate or issue SSL/TLS certificates, so it does not affect issuance. Fill it in only if the wizard requires a value.
• Description: a label for the request on the appliance, for example Certificate Signing Request. This is a local name only and is not written into the certificate.
• Company name: the full legal name of your organization, exactly as registered. This is used for Organization Validation (OV) and Extended Validation (EV) certificates. For a Domain Validation (DV) certificate the organization is not validated and does not appear in the issued certificate, so the value is effectively ignored. Leave it blank if the wizard allows, or enter your real legal name. Do not enter placeholder text such as NA.
• Department name: this is the Organizational Unit (OU). The CA/Browser Forum deprecated this attribute: certificates issued on or after September 1, 2022 must not include an Organizational Unit, and public CAs strip it during issuance. Leave this field blank.
• City: the full city name where your organization is registered, for example Los Angeles (not LA).
• State or Province: the full state or region name, for example California (not CA).
• Country Code: from the drop-down, select the two-letter ISO country code where your organization is registered, for example US.

Step 3: Generate and copy the CSR

Double-check every value, then click Save. A dialog box appears with your CSR. Click the Copy button to copy the whole block, then paste it into a plain-text editor such as Notepad. The CSR is a block of base64 text framed by BEGIN and END markers:

-----BEGIN CERTIFICATE REQUEST-----
MIIDXjCCAkYCAQAwgZQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlh
... (many lines of base64) ...
-----END CERTIFICATE REQUEST-----

Copy the entire block, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines, with no extra spaces or blank lines. Save the file (for example yourdomain.csr) on your PC. You will paste this CSR into the order form when you buy your certificate. After the CA validates the request and issues the certificate, install it by following how to install an SSL certificate on Citrix Access Gateway 5.0.

Verify the CSR before you submit it (optional)

It is worth confirming the details before you send the request to your CA. Paste the contents of the CSR into our CSR decoder to read back every field, and check that the Common Name matches the hostname clients will use. Errors caught here are cheap to fix; errors found after issuance mean a reissue.