NetScaler® ingress controller

SSL Passthrough support in Listener

March 18, 2026

Contributed by:

SSL Passthrough is a network configuration where the incoming SSL/TLS request is not decrypted by the Load Balancer (NetScaler). Instead, the encrypted traffic is forwarded directly to the designated backend server (the application pod) for decryption.

While the NetScaler does not decrypt the traffic, binding a certificate to the Listener is still mandatory.
The NetScaler performs Server Name Indication (SNI) matching on the client’s initial Client Hello message before forwarding the request. This provides an extra layer of routing and security verification.
SSL Passthrough is now supported for any Listener whenever it is referenced as an annotation in the Listener.
This support includes multicluster deployments.
- If the passthrough feature is enabled in a multicluster listener in one cluster, it must be enabled in all other clusters participating in the multicluster solution.
Passthrough is set at the listener level. All Ingresses referring to the listener will have passthrough enabled.

The Listener CRD controls the behavior of the front end virtual IP (VIP) on the NetScaler. The following parameter must be included in the Listener spec:

Parameter	Value	Default	Description
passthrough	True	False	Enables the SSL Passthrough for this Listener’s VIP and port.

Example Listener CRD

apiVersion: citrix.com/v1
kind: Listener
metadata:
  name: listener-https-passthrough
  namespace: default
spec:
  multicluster: true # Required for this feature to be active
  vip: '1.2.3.4'
  port: 443
  protocol: https
  passthrough: true # Enables SSL Passthrough
  certificates:
  - secret:
    name: app-secret # Mandatory certificate binding
<!--NeedCopy-->

Ingress YAML

No changes are required in the Ingress YAML definition to enable SSL Passthrough. The passthrough behavior is entirely controlled by the Listener CRD.

Here is a sample Ingress definition that refers to the configured Listener:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: https-ingress
  annotations:
    ingress.citrix.com/listener: listener-https-passthrough
spec:
  ingressClassName: "cic-vpx"
  rules:
  - host: httpsapp-netscaler.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: https-app
            port:
              number: 80
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

NetScaler Secure Deployment Guide

SSL Passthrough support in Listener

March 18, 2026

Contributed by:

March 18, 2026

Contributed by:

SSL Passthrough support in Listener

Example Listener CRD

Ingress YAML

In this article