I’ve been using Citrix on a lenovo for work for a few years now, and want to switch to a Mac, but I’m worried about performance differences. Does anyone have any insight or advice on this? I only use it to run certain software (don’t care about things like audio performance). Thanks!!!

I recently upgraded from NetScaler 13.1 to 14.1 and worked through NetScaler Console to enable zero-touch certificate management for my NetScaler HA pair. If you don't read the documentation at least once, you're going to get lost. Here is my brief summary.

Documentation:

https://docs.netscaler.com/en-us/citrix-adc/current-release/ssl/zero-touch-cert-manage.html

• You will add a public CA to NetScaler Console and configure a DNS provider for the verification process.
• You will then issue a cert from the CA and configure it for "Automatic (Zero Touch)" deployment.
  • The cert and its parts will then appear in the Zero-touch Certificate Management area of NS Console.
• In ZTCM area: Depending on the sync type for your NetScaler instances, you might need to select the instance then click "Add Existing Files" to add the certs that were generated.
• ### How the certs are bound to virtual servers...
• SSH (no GUI option yet) to netscaler and run:
  • set ssl vserver "my-vserver-name" -defaultSni "myvserver.domain.com-fqdn"
  • Your vserver will be unavailable at this point depending on how fast you perform the next step
• Unbind the existing cert from your vserver or the page/service will fail to load. With the original cert unbound, NetScaler will automatically match the ZTCM cert based on the defaultSni setting.

When ZTCM deploys the certs to your NS instance, on your NS you will see the "REMOTE" certs listed in Traffic Management -> SSL -> Certificates, but you cannot bind those certificates to your virtual servers. There will be no impact to service until defaultSni is set.

Based on my experience, there is downtime when moving to ZTCM, but if you're using SSH then you can probably pre-create the commands to set defaultSni and unbind the existing SSL cert instantly to almost eliminate downtime. When your vserver is unavailabe between defaultSni and unbinding the cert, there is a generic error page at the vserver address; the NetScaler doesn't show the vserver as being down. You will be able to access the site once the original cert is unbound.

I'm not sure if my experience makes sense because the documentation says that ZTCM is only activated when no manual cert bindings exist, however, my vserver:443 was unavailable after defining defaultSni and then available after removing the manual binding. I assumed there was a conflict between defaultSni and the bound cert.