Which two items must be true for a client to connect to an SSL offload virtual server without any SSL errors? (Choose two.)

Question

Options

• AThe root certificate is installed on the Citrix ADC.
• BThe server certificate is bound to the load-balancing virtual server.
• CThe server certificate is from a private certificate authority (CA).
• DThe root certificate is installed on the client's device.

• A
  9% (3)
• B
  73% (24)
• C
  18% (6)

Explanation

For a client to successfully establish an SSL connection to an SSL offload virtual server, the ADC must present a valid certificate to the client (B - the server certificate must be bound to the virtual server, or there's nothing to negotiate SSL with), and the client must trust that certificate (D - the root CA must be in the client's trust store, or the browser/OS will throw a certificate validation error).

Option A is wrong because the root certificate belongs on the client, not the ADC - the ADC is the one presenting the certificate, not validating it from the client side. The root CA on the ADC would matter for back-end SSL re-encryption scenarios, not client-facing offload.

Option C is wrong because there's no requirement for a private CA - a public CA certificate works just as well (and is often preferred). What matters is trust, not who issued it.

Memory tip: Use the handshake flow - ADC sends the cert (bound to vserver = B), client validates the cert (root CA on device = D). One action per side of the connection.

No community discussion yet for this question.