After successful authentication any connection is forwarded to the web app server, without any client certificate.įorward client certificate information via HTTP header Please note that this authentication now only take place at the SSL based virtual server. When browsing to the SSL based virtual server a user is now prompted which certificate to use for authentication, however only the client (user) certificate is shown that is signed by the root CA that is bind to our SSL based virtual server:Īfter this step client (user) certificate authentication is enabled as well. Time to get rid of that nasty SSL bridged traffic where Citrix NetScaler can’t dive into.įirst we created a SSL based virtual to replace the SSL_BRIDGE virtual server:īind ssl vserver VIP -WebApp -A -certkeyName public -a -caroot –CAīind ssl vserver VIP-WebApp-A -certkeyName public-a-caroot –CA Two weeks ago I got a call that the web app authorization process has been changed successfully. We advised the web app developer to dive into the process to change the authorization from a client certificate to HTTP header (where we can put the client certificate into via Citrix NetScaler). Unfortunately we had to create a SSL bridged virtual server to offer the client certificate via Citrix NetScaler. This means with Citrix NetScaler we where not able to perform SSL offloading techniques because the web app requires a real client certificate presented by the client (user). This web app traditionally requires a client certificate to process the user request to the web app content. Based on the client certificate information a user will get a specific role assigned within the web app.

One of these applications is using public signed client (user) certificates. This company uses Citrix NetScaler as a reverse proxy for various web-based applications. Recently I implemented a Citrix NetScaler environment at a Dutch insurance company.

No client certificate presented