In SSL offload and acceleration
In Citrix ADC 13.0
In Citrix ADC
In All products
Product documentation
In SSL offload and acceleration
In Citrix ADC 13.0
In Citrix ADC
In All products
Citrix ADC
Current Release 12.1 11.1
View PDF

Configure SSL offloading with end-to-end encryption

September 21, 2020
Contributed by: 
C

A simple SSL offloading setup terminates SSL traffic (HTTPS), decrypts the SSL records, and forwards the clear text (HTTP) traffic to the back-end web servers. Clear text traffic is vulnerable to being spoofed, read, stolen, or compromised by individuals who succeed in gaining access to the back-end network devices or web servers.

You can, therefore, configure SSL offloading with end-to-end security by re-encrypting the clear text data and using secure SSL sessions to communicate with the back-end Web servers.

Configure the back-end SSL transactions so that the appliance uses SSL session multiplexing to reuse existing SSL sessions with the back-end web servers. It helps in avoiding CPU-intensive key exchange (full handshake) operations and also reduces the overall number of SSL sessions on the server. As a result, it accelerates the SSL transaction while maintaining end-to-end security.

To configure an end-to-end encryption deployment, perform the following steps:

  • Create SSL services
  • Create an SSL virtual server
  • Add a certificate-key pair
  • Bind the certificate-key pair to the SSL virtual server
  • Bind the services to the SSL virtual server

For information about adding services, virtual servers, certificate-key pairs, see SSL offloading configuration.

Sample values used in the configuration are listed in the table

Entity Name IP Address Port
SSL service service-ssl-1 198.51.100.5 443
SSL service service-ssl-2 198.51.100.10 443
SSL virtual server vserver-ssl 203.0.113.5 443
SSL certificate-key pair certkey-1 NA NA

Example:

add service service-ssl-1 198.51.100.5 SSL 443

add service service-ssl-2 198.51.100.10 SSL 443

add lb vserver vserver-ssl SSL 203.0.113.5 443

add ssl certKey certkey-1 -cert server_rsa_1024.pem -key server_rsa_1024.ky

bind ssl vserver vserver-ssl -certkeyName certkey-1

bind lb vserver vserver-ssl service-ssl-1

bind lb vserver vserver-ssl service-ssl-2

Configure SSL offloading with end-to-end encryption using the GUI

  1. Navigate to Traffic Management > Load Balancing > Services > Add.
  2. Add two services: service-ssl-1 and service-ssl-2.
  3. Navigate to Traffic Management > SSL > Certificates > Install.
  4. Add a certificate-key pair: certkey-1.
  5. Navigate to Traffic Management > Load Balancing > Virtual Servers > Add.
  6. Add a virtual server: vserver-ssl.
  7. Click OK.
  8. Click inside Load balancing Virtual Server Service Binding.
  9. In Select Service, click the arrow.
  10. In the Service dialog box, select service-ssl-1 and service-ssl-2.
  11. Click Select.
  12. Click Bind.
  13. Click Continue.
  14. In the Certificate section, click Server Certificate.
  15. In Select Server Certificate, click the arrow.
  16. In the Server Certificates dialog box, click certkey-1.
  17. Click Select.
  18. Click Bind.
  19. Click Continue.
  20. Click Done.

SSL offloading with end to end encryption

Configure SSL offloading with end-to-end encryption
September 21, 2020
Contributed by: 
C
September 21, 2020
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings
© 1999- Citrix Systems, Inc. All rights reserved.