Troubleshooting: Citrix NetScaler Cannot Validate SecureAuth Certificates with TLS 1.2 and SHA2-384

Version Affected: All
 
 

Overview

On certain versions of Citrix NetScaler, Internet Explorer 11 (IE11) cannot validate a SecureAuth certificate when TLS 1.2 is enabled, if that certificate uses a SHA2-384 signature.

Cause

Citrix NetScaler's implementation of TLS 1.2 has an issue validating x509 certificates signed with SHA2-384 when the client is IE11. Non-Citrix devices, such as a Cisco ASA SSL VPN, validate the same certificate correctly, and non-Microsoft browsers (such as Firefox or Chrome) connect to the NetScaler correctly using TLS 1.2 as well — the issue is specific to the IE11-and-NetScaler combination.

Resolution

If IE11 must be used, disable TLS 1.2 and enable TLS 1.0 in IE11's settings — this allows the connection through the Citrix NetScaler to succeed. If TLS 1.2 needs to stay enabled, use a non-Microsoft browser such as Firefox or Chrome instead. IE11 with TLS 1.2 enabled cannot be made to work against a NetScaler in this configuration.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.