Use TLS SNI to hide your servers (incl. Citrix) from IP-based mass exploitation
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A Hrih News story walks through hardening Citrix NetScaler TLS listeners against IP-based mass exploitation by using SNI enforcement. The author's lab tests on NetScaler CPX 13.0 and 14.1 show default vservers serve their certificate to clients with no or wrong SNI.