Configuring Client Certificate Authentication

Last published : Sep 03, 2026
Users logging on to a NetScaler Gateway virtual server can also be authenticated based on the client certificate attributes presented to the virtual server. Client certificate authentication can also be used with other authentication types, such as LDAP or RADIUS, to provide two-factor authentication.
To authenticate users based on the client-side certificate attributes, client authentication must be enabled on the virtual server and the client certificate must be requested. You must bind a root certificate to the virtual server on NetScaler Gateway.
When users log on to the NetScaler Gateway virtual server, after authentication, the user name information is extracted from the specified field of the certificate. Typically, this field is Subject:CN. If the user name is extracted successfully, the user is then authenticated. The authentication fails in the following cases.
  • If the user does not provide a valid certificate during the Secure Sockets Layer (SSL) handshake.
  • The user name extraction fails, authentication fails.
You can authenticate users based on the client certificate by setting the default authentication type to use the client certificate. You can also create a certificate action that defines what is to be done during the authentication based on a client SSL certificate.
Starting from Citrix Secure Access client for Windows version 24.8.1.15 and macOS version 25.11.1.1, during client certificate authentication, Citrix Secure Access automatically selects the client certificate based on CA certificates configured on NetScaler Gateway. In the previous releases, users had to use trial and error process to select the correct certificate for authentication when multiple certificates from different Certification Authorities are present.
Note:
  • Contact Citrix support to enable automatic selection of client certificates in macOS devices.
  • The automatic selection of client certificates is not supported in the App Store version of the Citrix Secure Access for macOS.
The following table illustrates different client certificate authentication scenarios:
CA certificate configurations Client certificate options Expected behavior of Citrix Secure Access™
CA1 is configured on NetScaler Gateway Client certificate 1 from CA1 Citrix Secure Access selects the client certificate automatically and proceeds with authentication without user interaction.
Client certificate 1 and client certificate 2 from CA 1 Citrix Secure Access selects the client certificate based on maximum expiry time and proceeds with authentication without user interaction.
CA1 and CA2 are configured on NetScaler Gateway Client certificate 1 and client certificate 2 either from CA 1 or CA 2 Citrix Secure Access selects the client certificate based on maximum expiry time and proceeds with authentication without user interaction.
Only 1 client certificate either from CA1 or CA2 Citrix Secure Access selects the client certificate automatically and proceeds with authentication without user interaction.
Client certificate 1 from CA1 and client certificate 2 from CA 2 Citrix Secure Access prompts the user with both client certificates and the user should select the client certificate based on their requirement.
Related information
Authentication and Authorization
Configuring and Binding a Client Certificate Authentication PolicyConfiguring Two-Factor Client Certificate AuthenticationConfiguring Smart Card Authentication

To configure the client certificate as the default authentication type by using the GUI

  1. Go to Configuration > NetScaler Gateway, and then click Global Settings.
  2. In the details pane, under Authentication Settings, click Change authentication CERT settings.
  3. Select ON to enable two factor authentication using the certificate as per your requirement.
  4. In User Name Field, select the type of certificate field that holds the user names.
  5. In Group Name Field, select the type of the certificate field that holds the group name.
  6. In Default Authorization Group, type the name of the default group, and then click OK.

Extracting the User Name from the Client Certificate

If client certificate authentication is enabled on NetScaler Gateway, users are authenticated based on certain attributes of the client certificate. After authentication is successful, the user name or the user and group name of the user are extracted from the certificate. Also, the policies specified for that user are applied.