Scenario: While attempting to access web server that is load balanced by a Citrix ADC using HTTPS, a user receives the message below. SSL/TLS error…

The error message, "You have not chosen to trust 'Certificate Authority'," indicates a broken certificate chain of trust. The user's client (e.g., web browser) cannot verify the server certificate because it was not presented with the necessary intermediate certificate(s) to link it to a trusted root Certificate Authority (CA) in the client's trust store. On a Citrix ADC, the administrator must explicitly link the server certificate to its intermediate CA certificate. This action ensures that the ADC sends the complete certificate chain (server and intermediate certificates) to the client during the SSL/TLS handshake, allowing the client to successfully validate the server's identity.

A. The private key is secret and must never be shared with users. It is used by the server (the Citrix ADC) to prove its identity.

B. The public key is part of the server certificate, which is already sent to the user during the SSL/TLS handshake.

D. Users' systems trust the Root CA, not individual server certificates. Manually installing the server certificate on every user device is impractical and not the correct procedure.

1. Citrix Product Documentation. (2023). Install

link

and update certificates.

Section: "Link a certificate-key pair"

Content: "If the certificate that you are installing is not issued by a Certificate Authority (CA) that is on the list of trusted CAs of the client browser

you must install a CA certificate from the issuing CA and link it to the server certificate... To complete the chain of trust

you must install the intermediate certificate on the ADC and link it to the server certificate." This directly confirms that linking the server certificate to its intermediate/CA certificate is the required action to resolve trust issues.

2. Citrix Product Documentation. (2023). SSL certificates.

Section: "Chain of trust"

Content: "A client must verify the authenticity of the server certificate before it can establish a secure connection. To authenticate a server certificate

the client requires the intermediate and root CA certificates... If the intermediate certificates are not installed on the ADC and linked to the server certificate

the client cannot authenticate the server certificate." This explains the underlying mechanism and the necessity of the action described in the correct answer.