SSL Passthrough support in Listener

Last published : Nov 14, 2026
SSL Passthrough is a network configuration where the incoming SSL/TLS request is not decrypted by the Load Balancer (NetScaler). Instead, the encrypted traffic is forwarded directly to the designated backend server (the application pod) for decryption.
  • While the NetScaler does not decrypt the traffic, binding a certificate to the Listener is still mandatory.
  • The NetScaler performs Server Name Indication (SNI) matching on the client's initial Client Hello message before forwarding the request. This provides an extra layer of routing and security verification.
  • SSL Passthrough is now supported for any Listener whenever it is referenced as an annotation in the Listener.
  • This support includes multicluster deployments.
    • If the passthrough feature is enabled in a multicluster listener in one cluster, it must be enabled in all other clusters participating in the multicluster solution.
  • Passthrough is set at the listener level. All Ingresses referring to the listener will have passthrough enabled.
The Listener CRD controls the behavior of the front end virtual IP (VIP) on the NetScaler. The following parameter must be included in the Listener spec:
Parameter Value Default Description
passthrough True False Enables the SSL Passthrough for this Listener's VIP and port.
Related information
Configure

Example Listener CRD

apiVersion: citrix.com/v1
kind: Listener
metadata:
  name: listener-https-passthrough
  namespace: default
spec:
  multicluster: true # Required for this feature to be active
  vip: '1.2.3.4'
  port: 443
  protocol: https
  passthrough: true # Enables SSL Passthrough
  certificates:
  - secret:
    name: app-secret # Mandatory certificate binding

Ingress YAML

No changes are required in the Ingress YAML definition to enable SSL Passthrough. The passthrough behavior is entirely controlled by the Listener CRD.
Here is a sample Ingress definition that refers to the configured Listener:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: https-ingress
  annotations:
    ingress.citrix.com/listener: listener-https-passthrough
spec:
  ingressClassName: "cic-vpx"
  rules:
  - host: httpsapp-netscaler.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: https-app
            port:
              number: 80

SSL Passthrough in multicluster mode

In multicluster mode, several clusters share one NetScaler and a single front-end VIP. Each cluster runs its own NetScaler Ingress Controller instance, and all of them share the same virtual server for the front-end VIP. SSL Passthrough behaves the same way as in a single cluster. NetScaler forwards the encrypted traffic to the backend pods in the cluster that owns the application, without decrypting it.
To enable SSL Passthrough on a shared VIP, deploy the same Listener in every cluster that shares the NetScaler. The following Listener fields must be identical in each cluster:
Field Value Description
vip Shared front-end IP address The single VIP that fronts all the clusters.
port Listener port, for example 443 Must be the same in every cluster.
protocol https Must be the same in every cluster.
passthrough true Enables SSL Passthrough. Must be enabled in every cluster.
multicluster true Marks the Listener as part of the multicluster solution.
You must also set the same multi-cluster prefix (multiClusterPrefix, for example mc) on every NetScaler Ingress Controller instance so that all of them share the same virtual server. For more information, see Multi-cluster ingress.
Deploy the following Listener in each cluster. Keep the vip, port, protocol, and passthrough values the same everywhere:
apiVersion: citrix.com/v1
kind: Listener
metadata:
  name: listener-https-passthrough
  namespace: default
spec:
  multicluster: true # Required in every cluster
  vip: '1.2.3.4' # Same shared VIP in every cluster
  port: 443
  protocol: https
  passthrough: true # Enable in every cluster
  certificates:
  - secret:
      name: app-secret # Certificate binding is mandatory
The Ingress resources in each cluster refer to this Listener with the ingress.citrix.com/listener annotation, exactly as in a single-cluster deployment. No passthrough-specific changes are needed in the Ingress.
Points to note:
  • Passthrough must be enabled on the Listener in all clusters that share the VIP. Do not mix passthrough and non-passthrough Listeners for the same shared VIP.
  • Binding a certificate to the Listener is mandatory, even though the NetScaler does not decrypt the traffic. The certificate is used for SNI matching.
  • The shared virtual server for the VIP stays up as long as at least one cluster still uses it. It is removed only after the last cluster withdraws its Listener and Ingress, so removing the application from one cluster does not disrupt the others.
  • A shared passthrough application is tracked across all the clusters that use it and is removed from the NetScaler only when the last cluster stops using it.