SSL handshake fails during monitor probe. Disabling DES_CBC_SHA cipher on the back end server resolves the issue.

To resolve this issue upgrade to NetScaler 11.0 GA or 10.5 60.x build.

Note: There is a bug in the current NetScaler build which offers cipher “DES_CBC_SHA” in client Hello. With TLS 1.2 enabled, NetScaler should not offer “DES_CBC_SHA” in client hello.

Problem Cause

As per RFC 5246, TLS 1.2 protocol must not negotiate DES-CBC-SHA cipher. For more information refer to RFC 5246.