On NetScaler Gateway, you use certificates to create secure connections and to authenticate users.
To establish a secure connection, a server certificate is required at one end of the connection. A root certificate of the Certificate Authority (CA) that issued the server certificate is required at the other end of the connection.
When establishing a secure connection with a web browser on the user device, the server sends its certificate to the device.
When the user device receives a server certificate, the web browser, such as Internet Explorer checks to see which CA issued the certificate and if the CA is trusted by the user device. If the CA is not trusted, or if it is a test certificate, the web browser prompts the user to accept or decline the certificate (effectively accepting or declining the ability to access the site).
NetScaler Gateway supports the following three types of certificates:
Citrix recommends using a certificate signed by a trusted CA, such as Thawte or VeriSign.