I85PREP
⌘ K
Citrix CCA-N study materials
Citrix CCA-N study resources

Citrix CCA-N: SSL/TLS offloading and certificate management

Citrix CCA-N · Work through your exam, one topic at a time.

All guide sections

SSL/TLS offloading and certificate management

What this domain tests

SSL/TLS offloading questions check whether you can terminate TLS on the ADC, present a valid certificate chain, and control ciphers and backend encryption. Certificate management is a frequent source of outages.

Core rules

  • An SSL vserver terminates client TLS. The certificate and private key are bound to the vserver; the CA chain must be linked so clients can build a trusted path.
  • Certificate types include server, root CA, intermediate CA, and client. A server certificate needs a matching private key; a CSR is generated on the ADC or externally.
  • SSL profiles define protocol versions, ciphers, and settings. Frontend and backend profiles can differ. TLS 1.2 and 1.3 support depends on firmware and profile.
  • Backend encryption can be enabled on the service or service group so traffic from ADC to server is also TLS. SSL bridge passes encrypted traffic through without termination.
  • SNI allows multiple certificates on one VIP. OCSP stapling and CRL checks affect revocation validation.
  • Certificate expiry, hostname mismatch, and incomplete chains are the common validation failures.

Worked example

Users see a certificate warning on https://shop.example.com, but the certificate itself is valid and not expired. The ADC has the server certificate bound, but the intermediate CA is missing. Reasoning: the client trusts the root CA, but without the intermediate it cannot build the chain. The fix is to install the intermediate certificate and link it to the server certificate, then bind the chain to the SSL vserver. If the site also uses a different hostname on the same VIP, SNI or a wildcard/SAN certificate is needed.

Traps that cost marks

Binding only the leaf certificate is not enough for public CAs. A certificate can be valid but for the wrong common name/SAN. Changing the SSL profile can disable older clients. Backend SSL is not automatic when frontend SSL is enabled. Do not confuse SSL offloading with SSL bridging; offloading terminates and re-originates only if backend encryption is configured.