A Citrix Administrator needs to confirm that all client certificates presented to the authentication virtual server are valid until at least the year 2025. Which expression can the administrator use…

Question

Options

• ACLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2025)
• BCLIENT.SSL.ORIGIN_SERVER_CERT.VALID_NOT_AFTER.EQ(GMT2025)
• CCLIENT.SSL.CLIENT_CERT.YEAR_TO_EXPIRE.EQ(GMT2025)
• DCLIENT.SSL.ORIGIN_SERVER_CERT.EQ(GMT2025)

• A
  79% (26)
• B
  3% (1)
• C
  6% (2)
• D
  12% (4)

Explanation

Option A correctly uses CLIENT.SSL.CLIENT_CERT to reference the certificate presented by the client to the authentication virtual server, and VALID_NOT_AFTER is the proper NetScaler policy expression attribute that maps to the X.509 certificate's "Not After" expiry field - making it the right construct for checking certificate validity dates.

Why the distractors fail:

• B uses ORIGIN_SERVER_CERT instead of CLIENT_CERT - this inspects the backend server's certificate, not the one the client is presenting, so it checks the wrong entity entirely.
• C invents the attribute YEAR_TO_EXPIRE, which does not exist in NetScaler's advanced policy expression language; the correct attribute is VALID_NOT_AFTER.
• D also uses ORIGIN_SERVER_CERT (wrong direction) and omits the required validity attribute, making the expression both logically wrong and syntactically incomplete.

Memory tip: Think of it as whose cert are you checking? When a client authenticates, the client hands over its cert - so always start with CLIENT.SSL.CLIENT_CERT. The "Not After" field in any X.509 cert is the expiry boundary, so VALID_NOT_AFTER is your go-to attribute whenever a question involves certificate expiration validation.

No community discussion yet for this question.