Managing SSL Certificates in a Double-Hop DMZ Deployment

January 29, 2019

Contributed by: C

You must install the SSL certificates necessary to encrypt the connections among components in a double-hop DMZ deployment.

In a double-hop DMZ deployment, several different types of connections occur among the various components involved in the deployment. There is no end-to-end SSL encryption of these connections. However, each connection can be encrypted individually.

Encrypting a connection requires you to install the appropriate SSL certificate (either a trusted root or a server certificate) on the components involved in the connection.

The following table shows the connections that occur through the first firewall and the SSL certificates required to encrypt each of these connections. Encrypting the connections through the first firewall is mandatory to secure traffic sent over the Internet.

Connections through the first firewall	Certificates required for encryption
The web browser from the Internet connects to NetScaler Gateway in the first DMZ.	NetScaler Gateway in the first DMZ must have an SSL server certificate installed. The web browser must have a root certificate installed that is signed by the same Certificate Authority (CA) as the server certificate on NetScaler Gateway.
Citrix Receiver from the Internet connects to NetScaler Gateway in the first DMZ.	The certificate management for this connection is the same as the web browser to NetScaler Gateway connection. If you installed the certificates to encrypt the web browser connection, this connection is also encrypted using those certificates.

The following table shows the connections that occur through the second firewall and the SSL certificates required to encrypt each of these connections. Encrypting these connections enhances security but is not mandatory.

Connections through the second firewall	Certificates required for encryption
NetScaler Gateway in the first DMZ connects to the Web Interface in the second DMZ.	StoreFront or the Web Interface must have an SSL server certificate installed. NetScaler Gateway in the first DMZ must have a root certificate installed that is signed by the same CA as the server certificate on the Web Interface.
NetScaler Gateway in the first DMZ connects to NetScaler Gateway in the second DMZ.	NetScaler Gateway in the second DMZ must have an SSL server certificate installed. NetScaler Gateway in the first DMZ must have a root certificate installed that is signed by the same CA as the server certificate on NetScaler Gateway in the second DMZ.

The following table below shows the connections that occur through the third firewall and the SSL certificates required to encrypt each of these connections. Encrypting these connections enhances security but is not mandatory.

Connections through the third firewall	Certificates required for encryption
StoreFront or the Web Interface in the second DMZ connects to the XML Service hosted on a server in the internal network.	If the XML Service runs on Microsoft Internet Information Services (IIS) server on the XenApp server, an SSL server certificate must be installed on the IIS server. If the XML Service is a standard Windows service (does not reside in IIS), an SSL server certificate must be installed within the SSL Relay on the server. StoreFront or the Web Interface must have a root certificate installed that is signed by the same CA as the server certificate installed on either the Microsoft IIS server or the SSL Relay.
StoreFront or the Web Interface in the second DMZ connects to the STA hosted on a server in the internal network.	The certificate management for this connection is the same as the Web Interface to XML Service connection. You can use the same certificates to encrypt this connection. (The server certificate must reside on either the Microsoft IIS server or the SSL Relay. A corresponding root certificate must be installed on the Web Interface.)
NetScaler Gateway in the second DMZ connects to the STA hosted on a server in the internal network.	The SSL server certificate management for the STA in this connection is the same as described for the two previous connections discussed in this table. (The server certificate must reside on either the Microsoft IIS server or the SSL Relay.) NetScaler Gateway in the second DMZ must have a root certificate installed that is signed by the same CA as the server certificate used by the STA and XML service.
NetScaler Gateway in the second DMZ makes an ICA connection to a published application on a server in the internal network.	An SSL server certificate must be installed within the SSL Relay on the server hosting the published application. NetScaler Gateway proxy in the second DMZ must have a root certificate installed that is signed by the same CA as the server certificate installed within the SSL Relay.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Managing SSL Certificates in a Double-Hop DMZ Deployment

January 29, 2019

Contributed by: C

Managing SSL Certificates in a Double-Hop DMZ Deployment

Managing SSL Certificates in a Double-Hop DMZ Deployment

In this article