Citrix Gateway

Planning for Security

October 5, 2020

Contributed by:

When planning your Citrix Gateway deployment, you should understand basic security issues associated with certificates, and with authentication and authorization.

Configuring Secure Certificate Management

By default, Citrix Gateway includes a self-signed Secure Sockets Layer (SSL) server certificate that enables the appliance to complete SSL handshakes. Self-signed certificates are adequate for testing or for sample deployments, but Citrix does not recommend using them for production environments. Before you deploy Citrix Gateway in a production environment, Citrix recommends that you request and receive a signed SSL server certificate from a known Certificate Authority (CA) and upload it to Citrix Gateway.

If you deploy Citrix Gateway in any environment where Citrix Gateway must operate as the client in an SSL handshake (initiate encrypted connections with another server), you must also install a trusted root certificate on Citrix Gateway. For example, if you deploy Citrix Gateway with Citrix Virtual Apps and the Web Interface, you can encrypt connections from Citrix Gateway to the Web Interface with SSL. In this configuration, you must install a trusted root certificate on Citrix Gateway.

Authentication Support

You can configure Citrix Gateway to authenticate users and to control the level of access (or authorization) that users have to the network resources on the internal network.

Before deploying Citrix Gateway, your network environment should have the directories and authentication servers in place to support one of the following authentication types:

LDAP
RADIUS
TACACS+
Client certificate with auditing and smart card support
RSA with RADIUS configuration
SAML authentication

If your environment does not support any of the authentication types in the preceding list, or you have a small population of remote users, you can create a list of local users on Citrix Gateway. You can then configure Citrix Gateway to authenticate users against this local list. With this configuration, you do not need to maintain user accounts in a separate, external directory.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Planning for Security

October 5, 2020

Contributed by:

October 5, 2020

Contributed by:

Planning for Security

Configuring Secure Certificate Management

Authentication Support

In this article