This trace study looks at client certificate authentication taking place at both the frontend and backend.

This example trace was carried out in a practice lab environment with the following IP Addresses

• Client IP - 10.90.33.156
• VIP - 10.90.46.28
• SNIP - 10.90.46.26
• Backend 10.90.46.13

---

Instructions

The load balanced vserver is configured with Client Cert authentication set to Mandatory:

The NetScaler client certificate is bound to the Service:

At the backend, the Web server also requires Client Cert:

First, we can see the Client cert request is sent when the vServer sends its certificate to the client:

When the Client cert authentication is complete on frontend, the NetScaler connects to backend and completes SSL handshake:

After the SSL handshake, the NetScaler makes a request for the resource which requires client certificates. This begins the SSL Renegotiation:

The NetScaler then sends its own client certificate:

Notice that if SSL Renegotiation is set to DENY ALL, the connection will fail after the server Hello Request:

Also note that when the trace is encrypted, it just shows a load of PSH, ACKs:

This trace study looks at client certificate authentication taking place at both the frontend and backend.

CTX205823 - How Do I Enable SSL Client Certificate Authentication on NetScaler