Configure a FIPS appliance for the first time

Last published : Sep 24, 2026
Note
A certificate-key pair is required for HTTPS access to the configuration utility and for secure remote procedure calls. RPC nodes are internal system entities used for system-to-system communication of configuration and session information. One RPC node exists on each appliance. This node stores the password, which is checked against the one provided by the contacting appliance. To communicate with other NetScaler appliances, each appliance requires knowledge of the other appliances, including how to authenticate on the other appliance. RPC nodes maintain this information, which includes the IP addresses of the other NetScaler appliances and the passwords used to authenticate on each.
On a NetScaler MPX appliance virtual appliance, a certificate-key pair is automatically bound to the internal services. On a FIPS appliance, a certificate-key pair must be imported into the hardware security module (HSM) of a FIPS card. To do so, you must configure the FIPS card, create a certificate-key pair, and bind it to the internal services.
Related information

Configure secure HTTPS by using the CLI

To configure secure HTTPS by using the CLI, follow these steps
  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see one of the following links:
  2. If the appliance is part of a high availability setup, enable the SIM. For information about enabling the SIM on the primary and secondary appliances, see Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:
    import ssl fipskey serverkey -key ns-server.key -inform PEM
  4. Add a certificate-key pair. At the command prompt, type:
    add certkey server -cert ns-server.cert -fipskey serverkey
  5. Bind the certificate-key created in the previous step to the following internal services. At the command prompt, type:
    bind ssl service nshttps-127.0.0.1-443 -certkeyname server
    bind ssl service nshttps-::11-443 -certkeyname server

Configure secure HTTPS by using the GUI

To configure secure HTTPS by using the GUI, follow these steps:
  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see one of the following links:
  2. If the appliance is part of a high availability setup, enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, see the Import an existing FIPS key section.
  4. Navigate to Traffic Management > SSL > Certificates.
  5. In the details pane, click Install.
  6. In the Install Certificate dialog box, type the certificate details.
  7. Click Create, and then click Close.
  8. Navigate to Traffic Management > Load Balancing > Services.
  9. In the details pane, on the Action tab, click Internal Services.
  10. Select nshttps-127.0.0.1-443 from the list, and then click Open.
  11. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  12. Select nshttps-::11-443 from the list, and then click Open.
  13. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  14. Click OK.

Configure secure RPC by using the CLI

To configure secure RPC by using the CLI, follow these steps:
  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see one of the following links:
  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:
    import ssl fipskey serverkey -key ns-server.key -inform PEM
  4. Add a certificate-key pair. At the command prompt, type:
    add certkey server -cert ns-server.cert -fipskey serverkey
  5. Bind the certificate-key pair to the following internal services. At the command prompt, type:
    bind ssl service nsrpcs-127.0.0.1-3008 -certkeyname server
    bind ssl service nskrpcs-127.0.0.1-3009 -certkeyname server
    bind ssl service nsrpcs-::1l-3008 -certkeyname server
  6. Enable secure RPC mode. At the command prompt, type:
    set ns rpcnode \<IP address\> -secure YES
    For more information about changing an RPC node password, see Change an RPC node password.

Configure secure RPC by using the GUI

To configure secure RPC by using the GUI, follow these steps:
  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see one of the following links:
  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, the Import an existing FIPS key section.
  4. Navigate to Traffic Management > SSL > Certificates.
  5. In the details pane, click Install.
  6. In the Install Certificate dialog box, type the certificate details.
  7. Click Create, and then click Close.
  8. Navigate to Traffic Management > Load Balancing > Services.
  9. In the details pane, on the Action tab, click Internal Services.
  10. Select nsrpcs-127.0.0.1-3008 from the list, and then click Open.
  11. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  12. Select nskrpcs-127.0.0.1-3009 from the list, and then click Open.
  13. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  14. Select nsrpcs-::11-3008 from the list, and then click Open.
  15. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  16. Click OK.
  17. Navigate to System > Network > RPC.
  18. In the details pane, select the IP address, and click Open.
  19. In the Configure RPC Node dialog box, select Secure.
  20. Click OK.