Citrix ADC ingress controller

TLS client authentication support in Citrix ADC

February 3, 2022

Contributed by:

In TLS client authentication, a server requests a valid certificate from the client for authentication and ensures that it is only accessible by authorized machines and users.

You can enable TLS client authentication using Citrix ADC SSL-based virtual servers. With client authentication enabled on a Citrix ADC SSL virtual server, the Citrix ADC asks for the client certificate during the SSL handshake. The appliance checks the certificate presented by the client for normal constraints, such as the issuer signature and expiration date.

The following diagram explains the TLS client authentication feature on Citrix ADC.

TLS client authentication

TLS client authentication can be set to mandatory, or optional. If the SSL client authentication is set as mandatory and the SSL Client does not provide a valid client certificate, then the connection is dropped. A valid client certificate means that it is signed or issued by a specific Certificate Authority, and not expired or revoked. If it is marked as optional, then the Citrix ADC requests the client certificate, but the connection is not dropped. The Citrix ADC proceeds with the SSL transaction even if the client does not present a certificate or the certificate is invalid. The optional configuration is useful for authentication scenarios like two-factor authentication.

Configuring TLS client authentication

Perform the following steps to configure TLS client authentication.

Enable the TLS support in Citrix ADC.

The Citrix ingress controller uses the TLS section in the Ingress definition as an enabler for TLS support with Citrix ADC. The following is a sample snippet of the Ingress definition:
```
spec:
  tls:
   - secretName:
```
Apply a CA certificate to the Kubernetes environment.

To generate a Kubernetes secret for an existing certificate, use the following kubectl command:
```
    kubectl create secret generic tls-ca --from-file=tls.crt=cacerts.pem
```
Note:

You must specify ‘tls.crt=’ while creating a secret. This file is used by the Citrix ingress controller while parsing a CA secret.
Configure Ingress to enable client authentication.

You need to specify the following annotation to attach the generated CA secret which is used for client certificate authentication for a service deployed in Kubernetes.
```
ingress.citrix.com/ca-secret: '{"frontend-hotdrinks": "hotdrink-ca-secret"}' 
```
By default, client certificate authentication is set to mandatory but you can configure it to optional using the frontend_sslprofile annotation in the front end configuration.
```
ingress.citrix.com/frontend_sslprofile: '{"clientauth":"ENABLED", “clientcert”: “optional”}'
```
Note:

The frontend_sslprofile only supports the front end Ingress configuration. For more information, see front end configuration.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

TLS client authentication support in Citrix ADC

February 3, 2022

Contributed by:

February 3, 2022

Contributed by:

TLS client authentication support in Citrix ADC

Configuring TLS client authentication

In this article