Gateway

Enable TLS 1.3 protocol on NetScaler Gateway

February 26, 2025

Contributed by:

NetScaler Gateway enhances its security and performance capabilities by introducing support for the TLS 1.3 protocol, the latest security standard. Starting from release 14.1 build 43.50, you can configure NetScaler Gateway to use TLS 1.3 to secure the connection between NetScaler Gateway and VDA.

Note:

If the TLS 1.3 protocol fails, NetScaler Gateway attempts to use the next highest available version.

Enable TLS 1.3 protocol using GUI

Note:

Use the default back-end profile (ns_default_ssl_profile_backend) to enable TLS 1.3 on the back-end connections. Use the default front-end profile (ns_default_ssl_profile_frontend) or a custom profile to enable TLS 1.3 on the front-end connections. For more information, Set SSL profile parameters by using the GUI.

The default front-end and default back-end SSL profiles contain all the default ciphers and ECC curves, in addition to the settings that were part of the old profiles. The Enable Default Profile operation automatically binds the default front-end profile to all front-end entities, and the default back-end profile to all back-end entities. You can modify a default profile to suit your deployment. You can also create custom profiles and bind them to SSL entities. Before enabling the default profile, refer to Enable the default profile to understand the implications of this action.

To enable the default profile, navigate to Traffic Management > SSL > Settings > Change advanced SSL settings, select Enable Default Profile, and click OK.
Navigate to System > Profiles > SSL Profile.
Select ns_default_ssl_profile_backend and click the edit icon to edit the back-end profile.
Under Protocol, select TLSv13 and click OK.
To enable TLS 1.3 protocol for front-end connections, either modify the default profile ns_default_ssl_profile_frontend or edit an existing SSL profile.
Under Protocol, select TLSv13 and click OK.

Enable TLS 1.3 protocol using CLI

To enable TLS 1.3 protocol on the default front-end and back-end profiles, at the command prompt, type:

set ssl parameter -defaultProfile enaBLED
set ssl profile ns_default_ssl_profile_frontend -tls13 enaBLED
set ssl profile ns_default_ssl_profile_backend -tls13 enaBLED
 

To create a new front-end profile and enable the TLS 1.3 protocol, at the command prompt, type:

add ssl profile <new SSL profile> -sslProfileType FrontEnd
set ssl profile <name> -tls13 ENABLED
 

Compatibility matrix

The following table provides a compatibility matrix for VDA platforms that support TLS 1.3 and TLS 1.3 with HDX Insight, ensuring secure end-to-end connections between NetScaler Gateway and VDA.

Supported platforms	TLS 1.3	TLS 1.3 with HDX Insight
Windows	2407 and later	2503 and later
Linux	2407 and later	2503 and later

Limitations

In NetScaler Gateway release 13.1 and earlier, TLS 1.3 protocol is not supported for back-end connections from NetScaler Gateway to VDA.
TLS 1.3 protocol is supported only on Windows and Linux platforms of VDA.
TLS 1.3 is not supported on a NetScaler FIPS appliance.
TLS 1.3 handshake supports only RSA certificates with 1024-bit and larger keys.

For back-end connections, check the status of TLS 1.3 encryption using the following command:


ctxsession -v

Troubleshooting back-end connections

For front-end connections, check the status of TLS 1.3 encryption in the Citrix Workspace app. Navigate to Citrix Workspace Connection Center -> Client Connection Status and check the encryption status.

Troubleshooting front-end connections

References

For more information on the TLS 1.3 protocol, see Support for TLS 1.3 protocol.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Enable TLS 1.3 protocol on NetScaler Gateway

February 26, 2025

Contributed by:

Enable TLS 1.3 protocol on NetScaler Gateway

Enable TLS 1.3 protocol using GUI

Enable TLS 1.3 protocol using CLI

Compatibility matrix

Limitations

Troubleshooting TLS 1.3 related issues

References

In this article