For SSL offload, which certificate binding is required on the NetScaler?

• A. The Root Certificate is installed on the client.
• B. The Server Certificate is bound to the load-balancing virtual server.
• C. The Server Certificate is from a private certificate authority.
• D. The Root Certificate is installed on the NetScaler.

Answer: (B)

SSL offload relies on the NetScaler terminating the TLS session with clients at the load-balancing virtual server. To do this, the NetScaler must present a server certificate during the TLS handshake, so that certificate is bound to the vServer. Without binding the server certificate to the load-balancing virtual server, there’s no certificate the NetScaler can present, and TLS termination cannot occur. The root certificate on the client is what the client uses to trust the server certificate, not something the NetScaler binds for offload. A certificate from a private CA is fine as long as clients trust that CA, but the essential step is binding the server certificate to the vServer.