SSL Passthrough support in Listener

Last published : Sep 30, 2026
SSL Passthrough is a network configuration where the incoming SSL/TLS request is not decrypted by the Load Balancer (NetScaler). Instead, the encrypted traffic is forwarded directly to the designated backend server (the application pod) for decryption.
  • While the NetScaler does not decrypt the traffic, binding a certificate to the Listener is still mandatory.
  • The NetScaler performs Server Name Indication (SNI) matching on the client's initial Client Hello message before forwarding the request. This provides an extra layer of routing and security verification.
  • SSL Passthrough is now supported for any Listener whenever it is referenced as an annotation in the Listener.
  • This support includes multicluster deployments.
    • If the passthrough feature is enabled in a multicluster listener in one cluster, it must be enabled in all other clusters participating in the multicluster solution.
  • Passthrough is set at the listener level. All Ingresses referring to the listener will have passthrough enabled.
The Listener CRD controls the behavior of the front end virtual IP (VIP) on the NetScaler. The following parameter must be included in the Listener spec:
Parameter Value Default Description
passthrough True False Enables the SSL Passthrough for this Listener's VIP and port.
Related information
Configure

Example Listener CRD

apiVersion: citrix.com/v1
kind: Listener
metadata:
  name: listener-https-passthrough
  namespace: default
spec:
  multicluster: true # Required for this feature to be active
  vip: '1.2.3.4'
  port: 443
  protocol: https
  passthrough: true # Enables SSL Passthrough
  certificates:
  - secret:
    name: app-secret # Mandatory certificate binding

Ingress YAML

No changes are required in the Ingress YAML definition to enable SSL Passthrough. The passthrough behavior is entirely controlled by the Listener CRD.
Here is a sample Ingress definition that refers to the configured Listener:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: https-ingress
  annotations:
    ingress.citrix.com/listener: listener-https-passthrough
spec:
  ingressClassName: "cic-vpx"
  rules:
  - host: httpsapp-netscaler.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: https-app
            port:
              number: 80