Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

SSL service monitoring

August 20, 2024
Contributed by: 
C C

The Citrix ADC appliance has built-in secure monitors, TCPS and HTTPS. You can use the secure monitors to monitor HTTP as well as non-HTTP traffic. To configure a secure HTTP monitor, select the monitor type as HTTP, and then set the secure flag. To configure a secure TCP monitor, select the monitor type as TCP, and then set the secure flag.The secure monitors work as described below:

  • Secure TCP monitoring. The Citrix ADC appliance establishes a TCP connection. After the connection is established, the appliance performs an SSL handshake with the server. After the handshake is over, the appliance closes the connection.
  • Secure HTTP monitoring. The Citrix ADC appliance establishes a TCP connection. After the connection is established, the appliance performs an SSL handshake with the server. When the SSL connection is established, the appliance sends HTTP requests over the encrypted channel and checks the response codes.

The following table describes the available built-in monitors for monitoring SSL services.

Monitor type Probe Success criteria (Direct condition)
TCP TCP connection; SSL handshake Successful TCP connection established and successful SSL handshake.
HTTP TCP connection; SSL handshake; Encrypted HTTP request Successful TCP connection is established, successful SSL handshake is performed, and expected HTTP response code in server HTTP response is encrypted.
TCP-ECV TCP connection; SSL handshake (Data sent to a server is encrypted.) Successful TCP connection is established, successful SSL handshake is performed, and expected TCP data is received from the server.
HTTP-ECV TCP connection; SSL handshake (Encrypted HTTP request) Successful TCP connection is established, successful SSL handshake is performed, and expected HTTP data is received from the server.

Sample configuration for HTTPS-ECV health check monitor

HTTP services have predefined monitors capable of Extended Content Verification (ECV). These monitors are used when a validation is required beyond a successful TCP connection. These monitors validate the service as UP, when all the following criteria are met:

  • A successful TCP connection.
  • A particular type of request must be generated.
  • A specific message is expected in reply from the Receive String.

For these monitors, a request string is configured along with a reply string. If the reply string received by the Citrix ADC monitor matches the configured string, then the service is marked UP.

Bind a monitor to a service by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Services, create a service, and specify the protocol as SSL. Click OK.
  2. Click in the Service to Load Balancing Monitor Binding pane, and click Add Binding.
  3. Choose the monitor type as HTTPS-ECV and click Edit.
  4. In the Configure Monitor pane under Basic Parameters tab, enter values for the following parameters:
    • Send String – The string that the monitor must send to the service.
    • Receive String – The string that the monitor must receive to mark the service as UP.
  5. Click OK to complete the monitor configuration.
  6. Click Select.
  7. Click Bind to bind the HTTPS-ECV monitor to the service.
  8. Click Close.

Create and bind a monitor to a service by using the CLI

At the command prompt, type:

add lb monitor <monitor-name> https-ecv
bind service <servicename> -monitorName https-ecv
<!--NeedCopy-->

Example:

add lb monitor monitor-1 https-ecv
bind services1 -monitor-1 https-ecv
<!--NeedCopy-->
SSL service monitoring
August 20, 2024
Contributed by: 
C C
August 20, 2024
Contributed by: 
C C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.