I85PREP
⌘ K
Citrix CCP-N study materials
Citrix CCP-N study resources

Citrix CCP-N: SSL/TLS Offloading and Certificate Management

Citrix CCP-N · Work through your exam, one topic at a time.

All guide sections

SSL/TLS Offloading and Certificate Management

This domain tests TLS termination, certificate chains, SNI, SSL profiles, and policy. Exam questions usually describe a client certificate warning or a backend TLS failure and ask you to identify the configuration gap.

Core rules

  • An SSL virtual server terminates TLS. Its service can be HTTP for offload or SSL for end-to-end encryption. SSL bridge passes encrypted traffic without termination.
  • A certKey binds a certificate and private key. Link the server certificate to the intermediate CA, then bind the certKey to the SSL virtual server. The root certificate is usually not sent to clients.
  • SNI lets one VIP present multiple certificates. Without SNI, the default certificate is used for every hostname.
  • SSL profiles control protocol versions, cipher suites, HSTS, session reuse, and other settings. Front-end and back-end profiles are configured separately.
  • OCSP stapling and CRL checks validate revocation; client certificate authentication is a policy decision.

Worked example

A wildcard certificate for *.example.com is bound to an SSL VIP. Desktop browsers work, but some mobile clients report an incomplete certificate chain. The leaf certificate is being sent without the intermediate CA. The fix is to import the intermediate CA, create a certKey for it, link the leaf certificate to the intermediate, and bind the resulting chain. The reasoning is that browsers may fetch missing intermediates through the certificate AIA extension, but mobile clients often do not, so the server must send the full chain except the root.

Traps that cost marks

A certificate and private key mismatch prevents binding. A missing intermediate causes chain errors even when the leaf is valid. Binding a certificate to a service instead of the SSL virtual server is wrong. SSL profile settings can override expected protocol or cipher behavior. A service configured as HTTP will fail against a backend that requires HTTPS. Multiple certificates on one VIP without SNI will present the default certificate. Expired certificates are not automatically caught unless you monitor expiry.

Key selection rules

Choose TLS versions and ciphers that match the oldest supported client. TLS 1.3 cipher suites are handled differently from TLS 1.2 suites and may not be individually configurable the same way. Test with the actual client population before disabling older protocols.