How Do I Configure end-to-end SSL on NetScaler?
Use Case
In a simple SSL Offloading scenario, the communication between the client and the NetScaler is over a secure HTTPS connection whereas the communication from NetScaler to backend server is over a
HTTP based connection wherein the data is passed as plain text. However, in cases wherein the
NetScaler and the backend servers do not reside in the same data centre or the backend servers are hosted on the cloud, there is an increased risk of the clear text data being compromised/spoofed/read/stolen by any individual who manages to get access to the backend network. Thus arises the need to encrypt the communication between the NetScaler and the backend servers as well. This is where one can consider configuring end to end SSL on NetScaler.
Figure: End to End SSL Configuration on NetScaler
Introduction to SSL end to end configuration
The NetScaler performs the below mentioned activities in an end-to-end SSL configuration:
Front-end (Client-side) Encryption: The NetScaler terminates the secure Client side session and decrypts the data.
Back-end (Server-side) Encryption: The NetScaler initiates a secure connection with the backend servers and sends the re-encrypted data.
SSL session multiplexing: NetScaler appliance uses SSL session multiplexing to reuse existing
SSL sessions with the back-end web servers. Doing this avoids CPU-intensive key exchange
(full handshake) operations and reduces the overall number of SSL sessions on the server thereby accelerating the SSL transaction while maintaining end-to-end security.
Configuration Steps
Step1 : Enable SSL Offloading feature
On NS GUI: Go to System >> Settings >> Configure Basic Features >> Check SSL Offloading
(Ensure that Load balancing is checked as well)
Step 2: Add SSL based services
Note: The service that is configured must use SSL protocol to ensure that the backend connection is secure. If configured as HTTP service, then it will not support NS to backend server security and hence it will not be an end to end SSL configuration.
On NS GUI: Go to Traffic Management >> Load Balancing >> Services >> Add
Step 3: Add an SSL virtual server
On NS GUI: Go to Traffic Management >> Load Balancing >> Virtual Servers >> Add
Step 4: Add a certificate-key pair
On NS GUI: Go to Traffic Management >> SSL >> Certificates >> Install
Step 5: Bind the SSL key pair to the SSL vserver
On NS GUI: Go to Traffic Management >> Load Balancing >> Virtual Servers >> Select the virtual server you wish to bind the certificate to >> Edit >> Certificates >> Server Certificates >> Select the certificate you wish to bind to the virtual server >> Bind
Step 6: Bind the SSL services to the SSL virtual server
On NS GUI: Go to Traffic Management >> Load Balancing >> Virtual Servers >> Select the virtual server you wish to bind the services to >> Edit >> Service Binding >> Select the services to be bound to virtual server >> Bind
For additional configuration details you can check the link: http://docs.citrix.com/enus/netscaler/11/traffic-management/ssl/config-ssloffloading.html
Additional/Optional configuration steps
There are two additional key features on backend SSL which you can configure:
- Doing server certificate authentication on NS by enabling it on NS:
- Sending client certificate to the backend sever for authentication
Server Certificate Authentication on NS
The server certificate authentication can be enabled on a NetScaler SSL service when the NetScaler wants to verify that the certificate sent by the backend server is for the same hostname as requested by the client.
On NS GUI: Go to Traffic Management >> Load Balancing >> Services >> Select the SSL service on which you wish to enable Server Cert Auth >> Edit >> SSL Parameters >> Enable Server
Authentication
Sending Client Certificate to the Backend Server
Usually this option need not be enabled if NetScaler and Server reside in the same secure zone. If not the case, then this option can be enabled for additional security. The bound Client Certificate would be sent to the backend sever when the server demands a certificate from the client (in this case NetScaler) to authenticate its identity.
On NS GUI: Go to Traffic Management >> Load Balancing >> Services >> Select the SSL service on which you wish to enable Server Cert Auth >> Edit >> Certificates >> Client Certificates
