sslaction
Configuration for SSL action resource.
Properties
(click to see Operations )
| Name | Data Type | Permissions | Description |
|---|---|---|---|
| name | <String> | Read-write | Name for the SSL action. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the action is created.
The following requirement applies only to the Citrix ADC CLI:
If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, "my action" or 'my action').
Minimum length = 1
|
| clientauth | <String> | Read-write | Perform client certificate authentication.
Possible values = DOCLIENTAUTH, NOCLIENTAUTH
|
| clientcertverification | <String> | Read-write | Client certificate verification is mandatory or optional.
Default value: Mandatory
Possible values = Mandatory, Optional
|
| ssllogprofile | <String> | Read-write | The name of the ssllogprofile.
Minimum length = 1
Maximum length = 127
|
| clientcert | <String> | Read-write | Insert the entire client certificate into the HTTP header of the request being sent to the web server. The certificate is inserted in ASCII (PEM) format.
Possible values = ENABLED, DISABLED
|
| certheader | <String> | Read-write | Name of the header into which to insert the client certificate. |
| clientcertserialnumber | <String> | Read-write | Insert the entire client serial number into the HTTP header of the request being sent to the web server.
Possible values = ENABLED, DISABLED
|
| certserialheader | <String> | Read-write | Name of the header into which to insert the client serial number. |
| clientcertsubject | <String> | Read-write | Insert the client certificate subject, also known as the distinguished name (DN), into the HTTP header of the request being sent to the web server.
Possible values = ENABLED, DISABLED
|
| certsubjectheader | <String> | Read-write | Name of the header into which to insert the client certificate subject. |
| clientcerthash | <String> | Read-write | Insert the certificate's signature into the HTTP header of the request being sent to the web server. The signature is the value extracted directly from the X.509 certificate signature field. All X.509 certificates contain a signature field.
Possible values = ENABLED, DISABLED
|
| certhashheader | <String> | Read-write | Name of the header into which to insert the client certificate signature (hash). |
| clientcertfingerprint | <String> | Read-write | Insert the certificate's fingerprint into the HTTP header of the request being sent to the web server. The fingerprint is derived by computing the specified hash value (SHA256, for example) of the DER-encoding of the client certificate.
Possible values = ENABLED, DISABLED
|
| certfingerprintheader | <String> | Read-write | Name of the header into which to insert the client certificate fingerprint. |
| certfingerprintdigest | <String> | Read-write | Digest algorithm used to compute the fingerprint of the client certificate.
Possible values = SHA1, SHA224, SHA256, SHA384, SHA512
|
| clientcertissuer | <String> | Read-write | Insert the certificate issuer details into the HTTP header of the request being sent to the web server.
Possible values = ENABLED, DISABLED
|
| certissuerheader | <String> | Read-write | Name of the header into which to insert the client certificate issuer details. |
| sessionid | <String> | Read-write | Insert the SSL session ID into the HTTP header of the request being sent to the web server. Every SSL connection that the client and the Citrix ADC share has a unique ID that identifies the specific connection.
Possible values = ENABLED, DISABLED
|
| sessionidheader | <String> | Read-write | Name of the header into which to insert the Session ID. |
| cipher | <String> | Read-write | Insert the cipher suite that the client and the Citrix ADC negotiated for the SSL session into the HTTP header of the request being sent to the web server. The appliance inserts the cipher-suite name, SSL protocol, export or non-export string, and cipher strength bit, depending on the type of browser connecting to the SSL virtual server or service (for example, Cipher-Suite: RC4- MD5 SSLv3 Non-Export 128-bit).
Possible values = ENABLED, DISABLED
|
| cipherheader | <String> | Read-write | Name of the header into which to insert the name of the cipher suite. |
| clientcertnotbefore | <String> | Read-write | Insert the date from which the certificate is valid into the HTTP header of the request being sent to the web server. Every certificate is configured with the date and time from which it is valid.
Possible values = ENABLED, DISABLED
|
| certnotbeforeheader | <String> | Read-write | Name of the header into which to insert the date and time from which the certificate is valid. |
| clientcertnotafter | <String> | Read-write | Insert the date of expiry of the certificate into the HTTP header of the request being sent to the web server. Every certificate is configured with the date and time at which the certificate expires.
Possible values = ENABLED, DISABLED
|
| certnotafterheader | <String> | Read-write | Name of the header into which to insert the certificate's expiry date. |
| owasupport | <String> | Read-write | If the appliance is in front of an Outlook Web Access (OWA) server, insert a special header field, FRONT-END-HTTPS: ON, into the HTTP requests going to the OWA server. This header communicates to the server that the transaction is HTTPS and not HTTP.
Possible values = ENABLED, DISABLED
|
| forward | <String> | Read-write | This action takes an argument a vserver name, to this vserver one will be able to forward all the packets.
Minimum length = 1
Maximum length = 127
|
| cacertgrpname | <String> | Read-write | This action will allow to pick CA(s) from the specific CA group, to verify the client certificate.
Minimum length = 1
Maximum length = 31
|
| ocspstapling | <String> | Read-write | This option is used to enable ocspStapling parameter for the SSL connection.
Possible values = ENABLED, DISABLED
|
| ocspcertvalidation | <String> | Read-write | This option is used to check the revocation status of client/server certificate in SSL handshake using OCSP.
Possible values = DISABLE, OPTIONAL, MANDATORY
|
| ocspcache | <String> | Read-write | Enable cache of OCSP response. Caching of response received from the OCSP responder enables faster response to the client and reduces the load on the OCSP responder.
Default value: DISABLED
Possible values = ENABLED, DISABLED
|
| inhandshakeclientauth | <String> | Read-write | This option dynamically enables client authentication for the specific SSL connection based on policy evaluation performed during ClientHello handshake message processing. It overrides the clientAuth setting configured on the SSL virtual server or the SSL frontend profile.
Possible values = ENABLED, DISABLED
|
| inhandshakeclientcertverification | <String> | Read-write | Specifies the type of client authentication and is applicable only when inHandshakeClientAuth is ENABLED. If set to MANDATORY, the appliance terminates the SSL handshake when the client fails to present a valid certificate. If set to OPTIONAL, the appliance requests a client certificate but continues the SSL transaction even if the certificate is missing or invalid. Default value is MANDATORY.
Possible values = Mandatory, Optional
|
| alpnhttp2 | <String> | Read-write | This option is used to enable or disable the HTTP/2 application protocol based on policy evaluation performed during ClientHello handshake message processing.
Possible values = ENABLED, DISABLED
|
| hits | <Integer> | Read-only | The number of times the action has been taken. |
| undefhits | <Integer> | Read-only | The number of times the action resulted in UNDEF. |
| referencecount | <Integer> | Read-only | The number of references to the action. |
| description | <String> | Read-only | Description of the action. |
| builtin | <String[]> | Read-only | Flag to determine whether ssl action is built-in or not.
Possible values = MODIFIABLE, DELETABLE, IMMUTABLE, PARTITION_ALL
|
| feature | <String> | Read-only | The feature to be checked while applying this config. |
| _nextgenapiresource | <String> | Read-only | . |
| __count | <Double> | Read-only | count parameter |
Operations
(click to see Properties )
- ADD
- DELETE
- GET (ALL)
- GET
- COUNT
Some options that you can use for each operations:
-
Getting warnings in response: NITRO allows you to get warnings in an operation by specifying the 'warning' query parameter as 'yes'. For example, to get warnings while connecting to the NetScaler appliance, the URL is as follows:http:// <netscaler-ip-address> /nitro/v1/config/login?warning=yesIf any, the warnings are displayed in the response payload with the HTTP code '209 X-NITRO-WARNING'.
-
Authenticated access for individual NITRO operations: NITRO allows you to logon to the NetScaler appliance to perform individual operations. You can use this option instead of creating a NITRO session (using the login object) and then using that session to perform all operations,To do this, you must specify the username and password in the request header of the NITRO request as follows:X-NITRO-USER: <username>X-NITRO-PASS: <password>Note: In such cases, make sure that the request header DOES not include the following:Cookie:NITRO_AUTH_TOKEN= <tokenvalue>
*Note: * Mandatory parameters are marked in red and placeholder content is marked in green
add
URL: http:// <netscaler-ip-address> /nitro/v1/config/sslaction HTTP Method: POST
Request Headers:
Cookie:NITRO_AUTH_TOKEN= <tokenvalue>
Content-Type:application/json
Request Payload:
{"sslaction":{
<b>"name":<String_value>,
</b>"clientauth":<String_value>,
"clientcertverification":<String_value>,
"ssllogprofile":<String_value>,
"clientcert":<String_value>,
"certheader":<String_value>,
"clientcertserialnumber":<String_value>,
"certserialheader":<String_value>,
"clientcertsubject":<String_value>,
"certsubjectheader":<String_value>,
"clientcerthash":<String_value>,
"certhashheader":<String_value>,
"clientcertfingerprint":<String_value>,
"certfingerprintheader":<String_value>,
"certfingerprintdigest":<String_value>,
"clientcertissuer":<String_value>,
"certissuerheader":<String_value>,
"sessionid":<String_value>,
"sessionidheader":<String_value>,
"cipher":<String_value>,
"cipherheader":<String_value>,
"clientcertnotbefore":<String_value>,
"certnotbeforeheader":<String_value>,
"clientcertnotafter":<String_value>,
"certnotafterheader":<String_value>,
"owasupport":<String_value>,
"forward":<String_value>,
"cacertgrpname":<String_value>,
"ocspstapling":<String_value>,
"ocspcertvalidation":<String_value>,
"ocspcache":<String_value>,
"inhandshakeclientauth":<String_value>,
"inhandshakeclientcertverification":<String_value>,
"alpnhttp2":<String_value>
}}
Response: HTTP Status Code on Success: 201 Created
HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error
delete
URL: http:// <netscaler-ip-address> /nitro/v1/config/sslaction/ name_value<String> HTTP Method: DELETE
Request Headers:
Cookie:NITRO_AUTH_TOKEN= <tokenvalue>
Response: HTTP Status Code on Success: 200 OK
HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error
get (all)
URL: http:// <netscaler-ip-address> /nitro/v1/config/sslaction Query-parameters: attrs http:// <netscaler-ip-address> /nitro/v1/config/sslaction? attrs=property-name1,property-name2
Use this query parameter to specify the resource details that you want to retrieve.
filter http:// <netscaler-ip-address> /nitro/v1/config/sslaction? filter=property-name1:property-val1,property-name2:property-val2
Use this query-parameter to get the filtered set of sslaction resources configured on NetScaler.Filtering can be done on any of the properties of the resource.
view http:// <netscaler-ip-address> /nitro/v1/config/sslaction? view=summary
Use this query-parameter to get the summary output of sslaction resources configured on NetScaler.
Note: By default, the retrieved results are displayed in detail view (?view=detail).
pagination http:// <netscaler-ip-address> /nitro/v1/config/sslaction? pagesize=#no;pageno=#no
Use this query-parameter to get the sslaction resources in chunks.
HTTP Method: GET
Request Headers:
Cookie:NITRO_AUTH_TOKEN= <tokenvalue>
Accept:application/json
Response: HTTP Status Code on Success: 200 OK
HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error
Response Header:
Content-Type:application/json
Response Payload:
{ "sslaction": [ {
"name":<String_value>,
"clientauth":<String_value>,
"clientcertverification":<String_value>,
"clientcert":<String_value>,
"certheader":<String_value>,
"clientcertserialnumber":<String_value>,
"certserialheader":<String_value>,
"clientcertsubject":<String_value>,
"certsubjectheader":<String_value>,
"clientcerthash":<String_value>,
"certhashheader":<String_value>,
"clientcertfingerprint":<String_value>,
"certfingerprintheader":<String_value>,
"certfingerprintdigest":<String_value>,
"clientcertissuer":<String_value>,
"certissuerheader":<String_value>,
"sessionid":<String_value>,
"sessionidheader":<String_value>,
"cipher":<String_value>,
"cipherheader":<String_value>,
"owasupport":<String_value>,
"forward":<String_value>,
"cacertgrpname":<String_value>,
"clientcertnotbefore":<String_value>,
"certnotbeforeheader":<String_value>,
"clientcertnotafter":<String_value>,
"certnotafterheader":<String_value>,
"ocspcertvalidation":<String_value>,
"ocspstapling":<String_value>,
"ocspcache":<String_value>,
"inhandshakeclientauth":<String_value>,
"inhandshakeclientcertverification":<String_value>,
"alpnhttp2":<String_value>,
"hits":<Integer_value>,
"undefhits":<Integer_value>,
"referencecount":<Integer_value>,
"description":<String_value>,
"ssllogprofile":<String_value>,
"builtin":<String[]_value>,
"feature":<String_value>,
"_nextgenapiresource":<String_value>
}]}
get
URL: http:// <netscaler-ip-address> /nitro/v1/config/sslaction/ name_value<String> Query-parameters: attrs http:// <netscaler-ip-address> /nitro/v1/config/sslaction/ name_value<String> ? attrs=property-name1,property-name2
Use this query parameter to specify the resource details that you want to retrieve.
view http:// <netscaler-ip-address> /nitro/v1/config/sslaction/ name_value<String> ? view=summary
Use this query-parameter to get the summary output of sslaction resources configured on NetScaler.
Note: By default, the retrieved results are displayed in detail view (?view=detail).
HTTP Method: GET
Request Headers:
Cookie:NITRO_AUTH_TOKEN= <tokenvalue>
Accept:application/json
Response: HTTP Status Code on Success: 200 OK
HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error
Response Header:
Content-Type:application/json
Response Payload:
{ "sslaction": [ {
"name":<String_value>,
"clientauth":<String_value>,
"clientcertverification":<String_value>,
"clientcert":<String_value>,
"certheader":<String_value>,
"clientcertserialnumber":<String_value>,
"certserialheader":<String_value>,
"clientcertsubject":<String_value>,
"certsubjectheader":<String_value>,
"clientcerthash":<String_value>,
"certhashheader":<String_value>,
"clientcertfingerprint":<String_value>,
"certfingerprintheader":<String_value>,
"certfingerprintdigest":<String_value>,
"clientcertissuer":<String_value>,
"certissuerheader":<String_value>,
"sessionid":<String_value>,
"sessionidheader":<String_value>,
"cipher":<String_value>,
"cipherheader":<String_value>,
"owasupport":<String_value>,
"forward":<String_value>,
"cacertgrpname":<String_value>,
"clientcertnotbefore":<String_value>,
"certnotbeforeheader":<String_value>,
"clientcertnotafter":<String_value>,
"certnotafterheader":<String_value>,
"ocspcertvalidation":<String_value>,
"ocspstapling":<String_value>,
"ocspcache":<String_value>,
"inhandshakeclientauth":<String_value>,
"inhandshakeclientcertverification":<String_value>,
"alpnhttp2":<String_value>,
"hits":<Integer_value>,
"undefhits":<Integer_value>,
"referencecount":<Integer_value>,
"description":<String_value>,
"ssllogprofile":<String_value>,
"builtin":<String[]_value>,
"feature":<String_value>,
"_nextgenapiresource":<String_value>
}]}
count
URL: http:// <netscaler-ip-address> /nitro/v1/config/sslaction? count=yes HTTP Method: GET
Request Headers:
Cookie:NITRO_AUTH_TOKEN= <tokenvalue>
Accept:application/json
Response: HTTP Status Code on Success: 200 OK
HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error
Response Header:
Content-Type:application/json
Response Payload:
{ "sslaction": [ { "__count": "#no"} ] }