Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We migrated a bunch of our sites (changed static IP addresses) from an NGINX proxy to a Citrix NetScaler VPX instance. We tested our sites using every browser available, and they all appeared to be working properly. I changed my hosts file and navigated to each site to check if any browser would throw an exemption, and they didn't. However, after the migration we tested the SSL certs with Wormly's tool (see links below) and the sites failed in two different categories:
1) Trust
2) Renegotiation

After seeing this, we quickly migrated our sites back to our NGINX proxy for fear of a MIM exploit.

If anyone can give me some ideas as to what to check for or some steps that I can take to resolve this, I would appreciate it.

PS, please do not ask what the site names are, not only are they no longer on our netscaler, but posting compromising info about an eCommerce site seems like a really bad idea.

share|improve this question
up vote 0 down vote accepted

First, make sure you have your SSL certs linked correctly in the Netscaler config. You have to add the cert, add the intermediate cert, and then link the two together.

Second, for the renegotiation piece, it is configurable, see here:

Citrix have published articles on the various SSL tests and how they apply to them also. The short version is that thousands of sites are using SSL successfully on Netscaler, configured correctly it works and will pass the various tests :)

share|improve this answer
I had forgotten about this question... but you suggested the same exact way I solved the problem. – Troy Knapp Apr 5 '12 at 19:11
sorry - hadn't thought to look for load balancer tagged q's or I would have answered it a lot sooner :) – Adam C Apr 5 '12 at 22:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.