Which two items must be true for a client to connect to an SSL offload vServer without any SSL errors? (Choose two.)

For a client to connect to a Citrix ADC SSL offload virtual server without any SSL errors, a valid chain of trust must be established. This process has two fundamental requirements:
1. Server-Side Configuration: The Citrix ADC must be configured to present a server certificate to the client. This is accomplished by binding the specific server certificate (and its key) to the SSL virtual server. Without this binding, the vServer cannot perform the SSL handshake.
2. Client-Side Trust: The client's device (e.g., computer or mobile device) must trust the certificate presented by the ADC. For this to happen, the root certificate of the Certificate Authority (CA) that issued the server's certificate must be present in the client's trusted root certificate store.

A. The certificate can be from a public or private CA. As long as the client trusts the issuing root CA, the connection will be error-free.
C. The Citrix ADC does not require the root certificate to be installed on it to serve a certificate chain. It needs the server certificate and any intermediate certificates to send the chain to the client, but the client is expected to already have the root certificate for validation.

1. Citrix Official Documentation - Bind an SSL certificate-key pair to an SSL virtual server: "After you create an SSL virtual server

you must bind a certificate-key pair to it. The certificate is required for processing SSL transactions." This supports option B as a mandatory step.

Source: Citrix Product Documentation

"Bind an SSL certificate-key pair to an SSL virtual server

" Section: "Bind an SSL certificate-key pair to an SSL virtual server by using the GUI."

2. Citrix Official Documentation - Install

link

and update certificates: "If the server certificate is not issued by a CA whose certificate is on the official list of CAs that is included in the web browsers

you must also install the certificate of the issuing CA on the appliance. Link the server certificate to the CA certificate." This highlights the need for intermediate certificates on the ADC

but the ultimate trust anchor is the root certificate on the client

which supports option D.

Source: Citrix Product Documentation

"Install

link

and update certificates

" Section: "Certificate chain."

3. University Courseware - Public Key Infrastructure (PKI): Course materials on computer security and networking universally explain that for a client to trust a server's SSL/TLS certificate

the client's trust store must contain the root certificate of the authority that anchors the server certificate's chain of trust. This principle directly supports option D.

Source: MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017. Lecture 15 notes on Public Key Infrastructure. (General principle

not specific to Citrix

but universally applicable).