No option is available to change ciphers or SSL parameters on SSL_BRIDGE type virtual server.

To adjust ciphers or SSL parameters in this situation, the adjustments will need to be made on the backend servers themselves as they are terminating the SSL connection. Otherwise, the virtual server can be created as type SSL for which the NetScaler will do SSL offloading and therefore ciphers and SSL parameters will be configurable.

Problem Cause

For virtual servers of type SSL, we are able to customize the ciphers presented, as the NetScaler is terminating that connection between the client and the virtual server. However, on virtual servers of type SSL_BRIDGE the NetScaler is not terminating the connection but instead it is the backend servers that terminate, as there is no SSL offloading on the NetScaler for this traffic.

An SSL bridge configured on the NetScaler appliance enables the appliance to bridge all secure traffic between the SSL client and the SSL server. The appliance does not offload or accelerate the bridged traffic, nor does it perform encryption or decryption. Only load balancing is done by the appliance. The SSL backend server must handle all SSL-related processing, including the ciphers available to negotiate SSL/TLS with the clients.