To apply an existing certificate-based authentication policy to a Citrix Gateway virtual server, which action is essential?

• A. Bind the existing CERT authentication policy to the Citrix Gateway virtual server
• B. Change the client certificate to mandatory on the SSL parameters
• C. Enable client authentication on SSL parameters
• D. Create a CERT authentication policy and bind it to the Gateway virtual server

Answer: (A)

In Citrix Gateway, authentication policies are only applied when they are bound to the virtual server that handles the traffic. To enforce an existing certificate-based authentication policy on a Gateway vserver, you must attach that policy to the Gateway virtual server. Binding makes the policy active for that specific vserver, so any client presenting a certificate will be evaluated against the policy during authentication.

Creating a new policy isn’t necessary since one already exists, and enabling client authentication at the SSL level, while related to whether a client certificate is requested, does not by itself apply the policy. The essential step is binding the existing certificate-based authentication policy to the Gateway virtual server so it actually governs authentication for that traffic.