How Do I Configure SNI on NetScaler?
Use Case
Traditionally every separate application/website would have needed a separate IP address to be hosted.
This would have taken up too many IP addresses leading to a huge problem in the long term considering IP addresses are limited. Thus the need was to be able to host multiple applications/services on a single IP address.
Introduction to SNI?
What is SNI: SNI (Server Name Indication) is an extension of the TLS protocol which enables you to host multiple applications/services on a single IP address.
How it works: Servers supporting SNI have multiple certificates (pertaining to the multiple hostnames supported) bound to one single IP address. The client browser can indicate the requested hostname by including it in the ‘Client Hello’ of the SSL handshake and the server supporting SNI can send the correct certificate to the client depending on the hostname included in the request.
SNI feature support on NetScaler
You can enable the SNI feature on NetScaler appliance to be able to host multiple domains securely on a single SSL virtual server. It enables you to bind multiple certificates (pertaining to multiple domains) to a single virtual server. You can also bind a default certificates to the virtual server.
If the client browser indicates the requested hostname by including it in the ‘Client Hello’ of the SSL handshake, the SNI enabled virtual server would send the correct certificate (certificate mapping to the requested hostname) back to the client. In cases where the client does not specify any domain name, the virtual server would send the default certificate.
Configuration Steps
Step 1: Add SSL virtual server
On NS GUI: Go to Traffic Management >> Load Balancing >> Virtual Servers >> Add
For referring to additional details on basic SSL offloading, please visit following link: http://docs.citrix.com/en-us/netscaler/11/traffic-management/ssl/config-ssloffloading/config-sslvserver.html
Step 2: Enable SNI feature on the SSL virtual server
Goto Traffic Management >> Load Balancing >> Virtual Servers >> Select the virtual server and click on edit >>SSL Parameters and check ‘SNI Enable’
Step 3: Bind SNI certificate to SSL virtual server
You can bind multiple SNI certificates to the SSL virtual server
Bind sslvserver <ssl vservername> -certkeyname <certkeyname> -SNICert
Goto Traffic Management >> Load Balancing >> Virtual Servers >> Select the virtual server and click on edit >>Certificates >> Server Certificates >> Add Binding >> Select the certificate and check the
‘Server certificate for SNI’
Note: Optionally, you can also bind a default certificate as well.
In cases where the client does not specify any domain name, the NetScaler would send the default certificate.
Go to Traffic Management >> Load Balancing >> Virtual Servers >> Select the virtual server and click on edit >>Certificates >> Server Certificates >> Add Binding >> Select the certificate and do not check the ‘Server certificate for SNI’ box.
