Relay Credentials Tab

Use the Relay Credentials tab to configure the server certificate for the SSL Relay.

•	Key Store Location - The directory containing the certificate information used to present the relay’s identity to clients (NFuse-enabled Web servers). The default directory is %SystemRoot%\SSLRelay\keystore. Type the directory path or click Browse to search for it.

•	Display Friendly Name - This box determines which information from the certificate is displayed in the Server Certificate list. Some certificates contain an additional "Friendly name" field. Check this box to display the Friendly name for certificates that contain one. If this box is checked and there is no friendly name, the certificate’s subject common name is used-- typically the server name. If Display Friendly Name is not checked, the entire subject name is used.

•	Server Certificate - Select the server certificate to be used to identify the SSL Relay. Each certificate is separated by a dashed line. Select any of the lines of information on a particular certificate to select that certificate. Do not select the dashed lines.

•	Password - If a password is required for the selected server certificate, enter it in this box.

Related Topics

 Installing Server Certificates in the SSL Relay


Connection Tab

Use the Connection tab to configure the listener port and allowed destinations for the SSL Relay. The MetaFrame server and port specified on your NFuse-enabled Web server must be listed on this tab. By default, only the Citrix XML Service on the local host is listed. You can add multiple MetaFrame servers in the same farm to ensure redundancy.

•	Relay Listening Port - The TCP port where SSL clients connect to the SSL Relay. The default port number is 443. If your server has multiple IP addresses, this port is used on all of them. If you change this value, you must make the same change on the Web server. You may also need to open the port on any firewalls between the Web server and the SSL Relay.

•	Server IP Address - The IP address of a MetaFrame server to relay the decrypted packets to. By default, this is the IP address of the MetaFrame server on which the SSL relay is running.

•	Ports - The TCP port where the Citrix XML Service is running.

Related Topics

 Changing the target server or port


Target Server Properties Dialog Box

Use the Target Server Properties dialog box to configure the MetaFrame servers to which the SSL Relay forwards decrypted packets.

Related Topics

 Changing the target server or port


Ciphersuites Tab

Use the Ciphersuites tab to configure which combinations of ciphersuites the SSL Relay will accept from the client (an NFuse-enabled Web server). The left box lists the available ciphersuites and the box on the right lists the allowed ciphersuites. The SSL Relay accepts connections only from clients that support at least one of the allowed ciphersuites. Installing additional ciphersuites is not supported.

The following ciphersuites are included with the Citrix SSL Relay:

•	DHE_RSA_WITH_3DES_EDE_CBC_SHA

•	DHE_RSA_WITH_DES_CBC_SHA

•	DHE_RSA_EXPORT_WITH_DES40_CBC_SHA

•	RSA_WITH_3DES_EDE_CBC_SHA

•	RSA_WITH_RC1_128_SHA

•	RSA_WITH_RC4_128_MD5

•	RSA_WITH_DES_CBC_SHA

•	RSA_EXPORT_WITH_DES40_CBC_SHA

•	RSA_EXPORT_WITH_RC2_CBC_40_MD5

•	RSA_EXPORT_WITH_RC4_40_MD5

Descriptions of ciphersuites can be found in Appendix C of the Internet Society RFC 2246, available online at http://www.rfc-editor.org/rfc/rfc2246.txt

By default, connections using any of the supported ciphersuites are allowed. Select a ciphersuite from the right column and click Remove to disallow it. Select a ciphersuite from the left column and click Add to allow it.

Contact your organization’s security expert for guidance about which ciphersuites to use.


Installing Server Certificates in the SSL Relay

The Citrix SSL Relay supports server certificates in PEM, DER, and Base64-encoded DER formats. See the Service Pack 2 Installation Guide for instructions about obtaining a certificate.

To install a server certificate:

1	Copy the file(s) to the \certs subdirectory of the directory selected as the Key Store Location in the Relay Credentials tab.

The default path is %SystemRoot%\SSLRelay\keystore. Any file name and extension can be used. If the certificate is in DER format, name the certificate file NAME.der and the private key file NAME.key.

2	When the server certificate is installed, stop and re-start the SSL Service.

3	Switch to the Relay Credentials tab.

4	Select the server certificate in the Server Certificate drop-down list.

5	If a password is required for the selected server certificate, enter it in the Password box.

6	Click OK to close the SSL Relay Configuration Tool.

7	When asked to start the SSL Relay Service, click Yes.


What do the Green Check Marks Mean?

To the left of the title on each tab of the SSL Relay Configuration Tool there is either a green check mark or a red X. The check mark indicates that all of the settings on the tab match the settings saved in the Windows registry. Click Apply to save the changes to the registry or click OK to save the changes and exit the program. If you click Cancel and there are pending changes, you are given the option to save the changes or abandon them.


Introduction

Use the Citrix SSL Relay to secure communications between an NFuse-enabled Web server and your MetaFrame server farm. The data sent between the two servers is decrypted by the SSL Relay and then redirected using SOCKSv5 to the Citrix XML Service.

•	Use the Relay Credentials tab to configure the server certificate.

•	Use the Connection tab to configure the address and port combinations to which the SSL Relay forwards decrypted data. The SSL Relay only forwards packets to the servers and ports listed on this tab.

•	Use the Ciphersuites tab to select which ciphersuites to allow.

Configuring the SSL Relay involves the following steps:

1	Obtain a server certificate

2	Install the server certificate and then select it using the SSL Relay Configuration Tool

3	Select the ciphersuites to allow

4	Change the target address or port or add additional addresses for redundancy

Related Topics

 Installing Server Certificates in the SSL Relay

 Changing the target server or port


Changing the Target Server or Port

The SSL Relay only relays packets to servers and ports listed on the Connection tab. By default, the SSL Relay is configured to only relay packets to the Citrix XML Service running on the same MetaFrame server as the SSL Relay. You can add multiple MetaFrame servers in the same farm for redundancy. These additional MetaFrame servers must also be specified in the configuration of your NFuse-enabled Web servers.

The default TCP port for the Citrix XML Service is 80. The values specified in the SSL Relay must match the values used on your MetaFrame server. The TCP port for the Citrix XML Service can be checked by looking at the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CtxHttp\TcpPort on the MetaFrame server running the XML Service.

Note

You can configure the SSL Relay to relay packets to any port and any server, but this is not recommended because it is a security vulnerability.

To change the port for a server listed in the destination server list:

1	If you have not already done so, select the Connection tab.

2	Click the entry that you want to edit to select it.

3	Click Edit to display the Target Server Properties dialog box.

4	Select a destination port to remove and click Delete.

5	Type the number of the new destination port and click Add.

—or—

To allow connections to any port on the server, click Any in the Destination ports box.

6	Click OK to close the Target Server Properties dialog box.

To add a server to the destination server list:

1	Click New. The Target Server Properties dialog box appears.

2	Type the IP address of the MetaFrame server in the Server IP Address box.

—or—

To allow connections to any server, click Any in the Server IP Address box.

3	Type the port number of the Citrix XML Service in the Destination Ports box and click Add.

4	Click OK to close the Target Server Properties dialog box.


Server Certificate

A server certificate is a digital signature used to verify the identity of a computer. In the case of the Citrix SSL Relay, the certificate is installed on the MetaFrame server running the SSL Relay and presented to the NFuse-enabled Web server.


Secure Sockets Layer (SSL)

Secure Sockets Layer (SSL) is a standards-based architecture for encryption, authentication, and message integrity. It is used to secure the communications between two computers across a public network, authenticate the two computers to each other based on a separate trusted authority, and to ensure that the communications have not been tampered with. SSL supports a wide range of ciphersuites.


Key Store

The directory on the MetaFrame server running the SSL relay that contains the server certificate. The default directory is %SystemRoot%\SSLRelay\keystore\certs.


Citrix XML Service

The Citrix XML Service provides a HTTP interface to the ICA Browser. It uses TCP packets instead of UDP, which allows connections to work across most firewalls. The Citrix XML Service is installed as part of Service Pack 2 for MetaFrame 1.8. The default port for the Citrix XML Service is 80.


Ciphersuite

A ciphersuite is an encryption/decryption algorithm. When establishing an SSL connection, the client and server determine a common set of supported ciphersuites and then use the most secure one to encrypt the communications. Ciphersuites have different advantages in terms of speed, encryption strength, exportability, etc.


SOCKS

SOCKS is a protocol for TCP communications through a proxy. NFuse-enabled Web servers follow the SOCKS protocol for specifying the target server and port number and then encrypt each data packet using SSL.