Which configuration provides end-to-end encryption while allowing NetScaler to optimize responses?

• A. HTTP for the virtual server and HTTP for the services
• B. SSL Bridge for the virtual server and SSL for the services
• C. HTTP for the services and SSL for the virtual server
• D. SSL protocol for the virtual server and SSL protocol for the services

Answer: (D)

The ability to keep the data encrypted across the whole path while still letting NetScaler optimize responses comes from using TLS on both sides: front-end and back-end. When the virtual server is configured to use SSL and the backend services also use SSL, the NetScaler can terminate the client’s TLS connection, inspect and optimize the decrypted content, and then re-encrypt it for the backend. This setup preserves encrypted transport for both hops (client to NetScaler and NetScaler to services) while enabling the appliance to perform optimizations such as compression and caching on the plaintext inside the device. If either side were plain HTTP, encryption would be lost on that segment, and if only one side used SSL, end-to-end encryption wouldn’t be maintained through the full path.