Skip to content

Commit 3c21e32

Browse files
sreejithgssreejithgs
committed
fixed the formatting issue
1 parent 4051f37 commit 3c21e32

1 file changed

Lines changed: 113 additions & 0 deletions

File tree

‎simplified-deployment-usecases/TLS/ TLS_authentication.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# TLS client and server authentication
2+
3+
This topic provides information about TLS client and server authentication.
4+
5+
## TLS client authentication
6+
7+
In TLS client authentication, a server requests a valid certificate from the client for authentication and ensures that it is only accessible by authorized machines and users.
8+
You can enable the TLS client authentication using NetScaler SSL-based virtual servers. With client authentication enabled on a NetScaler SSL virtual server, the NetScaler asks for the client certificate during the SSL handshake. The appliance checks the certificate presented by the client for normal constraints, such as the issuer signature and expiration date.
9+
10+
TLS client authentication can be set to mandatory, or optional. If the SSL client authentication is set as mandatory and the SSL client does not provide a valid client certificate, then the connection is dropped. A valid client certificate means that it is signed or issued by a specific Certificate Authority, and not expired or revoked. If it is marked as optional, then the NetScaler requests the client certificate, but the connection is not dropped. The NetScaler proceeds with the SSL transaction even if the client does not present a certificate or the certificate is invalid. The optional configuration is useful for authentication scenarios like two-factor authentication.
11+
12+
### Configuring TLS client authentication
13+
14+
Create a Kubernetes certificate for the CA certificate with which client certificates are generated.
15+
16+
kubectl create secret generic tls-ca --from-file=tls.crt=cacerts.pem -n netscaler
17+
18+
**Note:** You must specify `tls.crt=` while creating a secret. This file is used by the Citrix ingress controller while parsing a CA secret.
19+
20+
You need to specify the `ingress.citrix.com/frontend_sslprofile` annotation to attach the generated CA secret which is used for the client certificate authentication for a service deployed in Kubernetes. For client authentication `clientauth` should be enabled using the `ingress.citrix.com/frontend_sslprofile` annotation. To know more about the SSL profile, see the [SSL profile documentation](./SSL-profile.md).
21+
22+
apiVersion: networking.k8s.io/v1
23+
kind: Ingress
24+
metadata:
25+
name: ingress-demo
26+
namespace: netscaler
27+
annotations:
28+
kubernetes.io/ingress.class: "netscaler"
29+
# annotation ingress.citrix.com/ca-secret is the CA for client certificate for authentication
30+
ingress.citrix.com/ca-secret: '{"ingress-demo": "tls-ca"}'
31+
# annotation ingress.citrix.com/frontend_sslprofile to configure different SSL settings for the frontend ingress
32+
ingress.citrix.com/frontend_sslprofile: '{"clientauth":"ENABLED", "sni": "enabled"}'
33+
spec:
34+
tls:
35+
- secretName: tls-secret
36+
rules:
37+
- host: "example.com"
38+
http:
39+
paths:
40+
- path: /
41+
pathType: Prefix
42+
backend:
43+
service:
44+
name: service-test
45+
port:
46+
number: 80
47+
48+
## TLS server authentication
49+
50+
[Server authentication](https://docs.citrix.com/en-us/citrix-adc/13/ssl/server-authentication.html) allows a client to verify the authenticity of the web server that it is accessing.
51+
Usually, the NetScaler appliance performs SSL offloading and acceleration on behalf of a web server and does not authenticate the certificate of the web server. However, you can authenticate the server in deployments that require end-to-end SSL encryption.
52+
53+
In such a situation, the NetScaler appliance becomes the SSL client and performs the following:
54+
55+
- carries out a secure transaction with the SSL server
56+
- verifies that a CA whose certificate is bound to the SSL service has signed the server certificate
57+
- checks the validity of the server certificate.
58+
59+
To authenticate the server, you must first enable server authentication and then bind the certificate of the CA that signed the certificate of the server to the SSL service on the NetScaler appliance. When you bind the certificate, you must specify the bind as a CA option.
60+
61+
### Configuring TLS server authentication
62+
63+
Perform the following steps to generate a Kubernetes secret for an existing certificate:
64+
65+
1. Generate a Kubernetes secret for the pre-existing client certificate which is used with the back-end service.
66+
67+
kubectl create secret tls tls-example-test --cert=path/to/tls.cert --key=path/to/tls.key -n netscaler
68+
69+
1. Generate a secret for an existing CA certificate. This certificate is required to sign the back end server certificate.
70+
71+
kubectl create secret generic example-test-ca --from-file=tls.crt=cacerts.pem -n netscaler
72+
73+
**Note:** You must specify 'tls.crt=' while creating a secret. This file is used by Citrix ingress controller while parsing a CA secret.
74+
75+
1. Create and apply the Ingress configuration.
76+
77+
To enable the TLS server authentication, set the `ingress.citrix.com/secure-backend` annotation in the ingress as `True`. The `ingress.citrix.com/backend-secret` annotation is used to provide the certificate for back-end server communication from NetScaler. Also, CA certificate can be provided using the `ingress.citrix.com/backend-ca-secret` annotation and the back end SSL profile can be used to enable server authentication.
78+
79+
apiVersion: networking.k8s.io/v1
80+
kind: Ingress
81+
metadata:
82+
name: ingress-demo
83+
namespace: netscaler
84+
annotations:
85+
kubernetes.io/ingress.class: "netscaler"
86+
# annotation ingress.citrix.com/ca-secret is the CA for client certificate for authentication
87+
ingress.citrix.com/ca-secret: '{"ingress-demo": "tls-ca"}'
88+
# annotation ingress.citrix.com/frontend_sslprofile to configure different SSL settings for the frontend ingress
89+
ingress.citrix.com/frontend_sslprofile: '{"clientauth":"ENABLED", "sni": "enabled"}'
90+
# annotation ingress.citrix.com/secure-backend is to make secure connection with backend service
91+
ingress.citrix.com/secure-backend: "True"
92+
# annotation ingress.citrix.com/backend-secret is used for providing certificate for secure connection with backend service.
93+
ingress.citrix.com/backend-secret: '{"service-test": "tls-example-test"}'
94+
# annotation ingress.citrix.com/backend-ca-secret for providing CA certificate used for authenticating secure backend communication.
95+
ingress.citrix.com/backend-ca-secret: '{"service-test":"example-test-ca"}
96+
# annotaion ingress.citrix.com/backend-sslprofile for setting different SSL settings for communication with backend services
97+
ingress.citrix.com/backend-sslprofile: '{"service-test":{"serverauth": "enabled", "sni": "enabled"}}'
98+
spec:
99+
tls:
100+
- secretName: tls-secret
101+
rules:
102+
- host: "example.com"
103+
http:
104+
paths:
105+
- path: /
106+
pathType: Prefix
107+
backend:
108+
service:
109+
name: service-test
110+
port:
111+
number: 443
112+
113+
**Note:** SNI can be enabled or disabled based on the certificate.

0 commit comments

Comments
 (0)