Legacy configuration

Configure NetScaler to disable SSLv2 redirect

If you enable the SSLv2 Redirect feature on NetScaler, it performs the SSL handshake and redirects the client to the configured URL. If this feature is disabled, NetScaler denies performing the SSL handshake process with SSLv2 clients.

Run the following command to disable SSLv2 redirect on the SSL virtual server and service:

set ssl vserver <vserver_name> -sslv2redirect DISABLED set ssl service <service_name> -sslv2redirect DISABLED

For more information, see Rewrite ports and protocols for HTTP redirection.

Configure NetScaler to disable cipher redirect

With cipher redirection, you can configure an SSL virtual server to deliver accurate, meaningful error messages when an SSL handshake fails. When an SSL handshake fails, NetScaler redirects the user to a previously configured URL. If no URL is configured, NetScaler displays an internally generated error page.

At the command prompt, run the following commands to configure cipher redirection and verify the configuration:

set ssl vserver <vServerName> -cipherRedirect DISABLED show ssl vserver <vServerName>

When you bind the default SSL profile to a virtual server in NetScaler, the SSL parameters for that virtual server are inherited from the bound profile. As a result, you cannot directly modify SSL parameters on the virtual server because the SSL profile controls these settings.

set ssl profile <ssl Profile name> -cipherredirect DISABLED

For more information, see Cipher redirection.

Configure NetScaler to prevent non-secure SSL renegotiation

Run the following command to disable SSL renegotiation:

set ssl parameter -denySSLReneg ALL

The following command allows renegotiation for secure clients and servers only:

set ssl parameter -denySSLReneg NONSECURE

For more information, see How to Configure and Use the -denySSLReneg Parameter.

Legacy configuration