Your PKI infrastructure is worthless if ...
A common mistake IT organizations make, is having a well-designed Public Key Infrastructure (PKI), but at the same time having client devices, such as monitoring agents for your Citrix NetScalers, which accept to set up any encrypted connection, to any device, no matter what certificate they are presenting. In this case, you basically allow connections to be made to devices you do not know whether they can be trusted. This makes you vulnerable for 'spoofing'.