Back-End Connection on TLS 1.1/1.2 from NetScaler to IIS Server Breaks

Back-end connection on TLS 1.1/1.2 from NetScaler to IIS server breaks.

The server Event Viewer has the following logs:
Event ID: 36874- TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

To resolve this issue upgrade to NetScaler 11.0 65.35. For more information refer to NetScaler 11.0 65.35 release notes and search for issue ID # 600155.

This issue is also fixed in NetScaler 11.1 and 12.0 GA build.

Workaround

Complete the following procedure to workaround this issue:
On NetScaler, disable TLS 1.2 on back-end SSL service/service group. This also takes care of the secure monitor SSL handshake.
> set ssl service <service name> -tls11 DISABLED -tls12 DISABLED
 
For SSL bridge and dynamically learnt services (used primarily in Gateway deployments), add the following parameters. This will disable TLS 1.1/1.2 globally for all SSL services. These parameters are available in NetScaler 11.0 64.x and NetScaler 10.5 60.7.
> set ssl parameter -svctls1112disable enable -montls1112disable enable

Note: If you are completing this procedure using the GUI management page, then ensure to verify if the configuration parameters appear disabled. It has been noticed that in some builds when completing the procedure using the GUI management page, the parameters are not saved to the configuration.

The latest IIS servers with TLS 1.2 support mandates “Signature Algorithms” extension in the client hello to complete the TLS 1.2 handshake. Currently NetScaler does not send this extension.

The problem occurs because of the way in which Microsoft has implemented TLS1.2 support in SCHANNEL. When the NetScaler is sending the SSL ClientHello, we are not specifying any “Signature Algorithms” in our part of the handshake. The is perfectly valid from an RFC perspective, and the RFC for TLS1.2 dictates the following: https://tools.ietf.org/html/rfc5246#section-7.4.1.4 

If the client does not send the signature_algorithms extension, the server MUST do the following:
- If the negotiated key exchange algorithm is one of RSA, DHE_RSA, DH_RSA, RSA_PSK, ECDH_RSA, ECDHE_RSA, then behave as if client had sent the value sha1,rsa.
- If the negotiated key exchange algorithm is one of DHE_DSS, DH_DSS, then behave as if the client had sent the value sha1,dsa.
- If the negotiated key exchange algorithm is one of ECDH_ECDSA, ECDHE_ECDSA, then behave as if the client had sent value sha1,ecdsa.

So the SCHANNEL is using the above and behaving as if the NetScaler had specified “sha1,rsa”. Since the Certificate installed has a SHA256 signature it would therefore be impossible for the SSL connection to continue, which is why the request is terminated by SCHANNEL.

Starting from 10.5 59.11 build, NetScaler supports TLS 1.1/1.2 on the back-end communication on all hardware platforms (MPX, SDX, MPX-FIPS). NetScaler VPX supports TLS 1.1/1.2 on the back-end communication starting with 11.0.66.11 ( NetScaler VPX on build prior to 11.0.66.11 does not support TLS 1.1/1.2 for the back-end communication) Please refer to the link below for more information on supported protocols and ciphers by the NetScaler Appliance.The implementation is per RFCs. But, some back-end servers may not completely comply to RFC defined SSL handshake behavior. In this case, IIS servers mandate client to send signature extension in client hello which NetScaler does not send (see RFC 5246 - 7.4.1.4.1. Signature Algorithms). Citrix is working on sending the required extension in client hello. Refer to the solution section for the workaround to this issue.
https://docs.citrix.com/en-us/netscaler/12/ssl/cipher_protocl_support_matrix.html

The two parameters (svctls1112disable and montls1112disable) cannot be disabled from CLI. If you must disable them, then edit the configuration (ns.conf) file as follows:

1. Remove these parameters from the "set ssl param” command.
2. Save the configuration.
3. Restart the appliance

Backend Connection Over TLS 1.2 Fails When SHA384/512 Certificate Is Bound on IIS Server:

An issue on NetScaler appliances using TLS 1.2 on backend connections has been reported to NetScaler Engineering. SSL handshake failure seen on backend when Microsoft IIS web servers have a greater than SHA256 based server certificate bound.

This is an expected behavior if you are running NetScaler release 11.0 because only SHA256 signed-certificates are supported on the back end of all appliances.

Support for SHA384 and SHA512 certificates on back end have been added in release 11.1 54.X. Refer to Note 3 on https://docs.citrix.com/en-us/netscaler/12/ssl/cipher_protocl_support_matrix.html