Disclaimer: I am not a network engineer but a software engineer so I may muddle my terminology, feel free to correct me where I go wrong!

My understanding of our set-up is:

We have a Netscaler (lets say F5) with valid (signed/trusted CA) SSL Certificates installed that are returned to clients. The Netscaler in turn communicates with our back-end servers running Windows 2008R2 and IIS 7 etc. These serve up websites/services via HTTPS (443) with their own certificates... However, these certificates may NOT be valid/trusted/signed.

In my world of "direct" communications I know that I would expect to see an error/warning saying that the certificate cannot be trusted. However, I am unsure how Netscaler would handle this condition. Would it return an error to the client or simply relay the data with Netscalers valid certificate? Would it throw some kind of error? Is this configurable etc?

Thank you very much.

  • Are you using Citrix Netscaler or an F5 appliance?
    – user6423
    Commented Jul 20, 2014 at 4:09

2 Answers 2


Citrix NetScaler will do this on explicit demand only.

http://docs.citrix.com/en-us/netscaler/10-5/ns-tmg-wrapper-10-con/ns-ssl-wrapper-con-10/ns-ssl-customize-ssl-config-con/ns-ssl-manage-server-auth-tsk.html (Archived here.)

the appliance does not usually authenticate the Web server's certificate. [...]
To authenticate the server, you must first enable server authentication and then bind the certificate of the CA that signed the server's certificate to the SSL service on the NetScaler. When binding the certificate, you must specify the bind as CA option.

  • The link presented above returns a 404 message. Do you have a current link that describes the verification process between the Netscaler appliance and the selected back end web server SSL session? Commented Sep 4, 2015 at 3:54
  • What is the process by which a self signed certificate at the back end web server farm is verified b ythe Netscaler appliance during an end to end SSL session? Commented Sep 4, 2015 at 3:56
  • @PolihronisIkonomou 1) Link fixed. 2) No idea. Never tried. Try putting this into a separate question. Commented Sep 7, 2015 at 7:00

I know its an old question, but here is the doc (for now) https://docs.citrix.com/zh-cn/netscaler/11-1/ssl/customize-ssl-config/manage-server-auth.html

If you create an SSL service (that connects to the server) it does not care one whit about the status of the server's certificate (by default). the NS handles the SSL offload between the NS and the client (a browser for example) and that is assumed to be enough. The service is in your network so there is an assumption of trust (not to mention much easier to manage). If you do want the NS to only connect to a web server/service with a valid cert, you can configure it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.