Configuring Client Certificate Authentication

Last published : Sep 03, 2026
Users logging on to a NetScaler Gateway virtual server can also be authenticated based on the client certificate attributes presented to the virtual server. Client certificate authentication can also be used with other authentication types, such as LDAP or RADIUS, to provide two-factor authentication.
To authenticate users based on the client-side certificate attributes, client authentication must be enabled on the virtual server and the client certificate must be requested. You must bind a root certificate to the virtual server on NetScaler Gateway.
When users log on to the NetScaler Gateway virtual server, after authentication, the user name information is extracted from the specified field of the certificate. Typically, this field is Subject:CN. If the user name is extracted successfully, the user is then authenticated. The authentication fails in the following cases.
  • If the user does not provide a valid certificate during the Secure Sockets Layer (SSL) handshake.
  • The user name extraction fails, authentication fails.
You can authenticate users based on the client certificate by setting the default authentication type to use the client certificate. You can also create a certificate action that defines what is to be done during the authentication based on a client SSL certificate.
Related information
Authentication and Authorization
Configuring and Binding a Client Certificate Authentication PolicyConfiguring Two-Factor Client Certificate AuthenticationConfiguring Smart Card Authentication

To configure the client certificate as the default authentication type by using the GUI

  1. Go to Configuration > NetScaler Gateway, and then click Global Settings.
  2. In the details pane, under Authentication Settings, click Change authentication CERT settings.
  3. Select ON to enable two factor authentication using the certificate as per your requirement.
  4. In User Name Field, select the type of certificate field that holds the user names.
  5. In Group Name Field, select the type of the certificate field that holds the group name.
  6. In Default Authorization Group, type the name of the default group, and then click OK.

Extracting the User Name from the Client Certificate

If client certificate authentication is enabled on NetScaler Gateway, users are authenticated based on certain attributes of the client certificate. After authentication is successful, the user name or the user and group name of the user are extracted from the certificate. Also, the policies specified for that user are applied.