Which statement is true regarding SSL offload prerequisites on NetScaler?

• A. The Root Certificate must be installed on the client.
• B. The Server Certificate must be bound to the load-balancing virtual server.
• C. The Server Certificate must be from a private CA.
• D. The Root Certificate must be installed on the NetScaler.

Answer: (B)

In SSL offload on NetScaler, the certificate the client sees must be the one bound to the load-balancing virtual server. Binding the server certificate to the virtual server tells the appliance which certificate and private key to present during the TLS handshake, so the client can establish a secure connection with the correct host name and trust chain. Without this binding, the virtual server has nothing to present, and TLS cannot succeed.

Certificates can come from public or private CAs, as long as they’re valid for the host name and the certificate chain is complete with any needed intermediates. The client’s trust is determined by its own trust store, not by something that must be installed on the NetScaler. Likewise, root certificates are not a strict prerequisite on the NetScaler for SSL offload; the more critical requirement is having the proper server certificate (and its chain) bound to the virtual server.