I've recently gotten more involved with handling certificate renewals on our NetScalers at work. One of the companies we do work for requires FIPS-compliant (not necessarily certified) NetScalers due to being government-adjacent. I've noticed when it comes to private key handling for server certificates, sometimes we use the original private key held in the NetScaler's Hardware Security Module (HSM) and other times we have the CA generate the private key and import the private key to the HSM (via a pfx or pem file). We've never failed an audit over this, although it seems like FIPS 140-2 requires that the private key never leave the HSM in order to remain compliant. Can anyone explain why Citrix NetScalers with FIPS 140-2 compliance allow for this, and if it is compliant, how the process remains compliant despite the original private key potentially floating around in plaintext?