Apache

Change all HTTP requests to SSL/HTTPS on a NetScaler

Published

I recently received a request to catch all requests on HTTP and redirect the user to the exact same URL that was requested but over SSL (HTTPS) instead. You can do this using a Responder Policy.

Basically the action to redirect over SSL will be:

"HTTP/1.1 301 Moved Permanently\r\n" + "Location: https://" + HTTP.REQ.HOSTNAME + HTTP.REQ.URL.PATH + "\r\n"

Make sure to Bypass the Safety check or it will give you an Input Expression is unsafe error. Don’t worry, this is just a warning message. The Netscaler tries to resolve URLs to make sure they respond when you write an expression. In this case we are telling it to catch any URL. So since it can’t validate something general like this, it throws the expression error. Make sure to bypass the safety check to get around this.

The responder policy that calls the action by looking for non-SSL connections should be:

!CLIENT.SSL.IS_SSL

You will notice I specified a 301 redirect in my action because I want to make sure any search engine spiders index my site URL as “https://www.mywebsite.com” and not as “http://www.mywebsite.com” for SEO purposes.

You may or may not want to bind the policy globally. I only apply responder policies to vservers that need them just to be cautious.

In this article:, ,

4 Comments

  1. Jonathan Polansky

    December 8, 2011 at 6:03 PM

    Thanks for the post Jason! And what’s the NetScaler command to bypass the safety checks, you may be asking? 30 mins of Google searching yields:

    http://support.citrix.com/proddocs/topic/netscaler-rewrite-93/ns-rw-bypass-sfty-chk-tsk.html

    > set rewrite action insertact -bypassSafetyCheck YES
    Done
    > show rewrite action insertact

    Name: insertact
    Operation: insert_http_header Target:Client-IP
    Value:CLIENT.IP.SRC
    BypassSafetyCheck : YES
    Hits: 0
    Undef Hits: 0
    Action Reference Count: 2
    Done

  2. Jochen

    January 9, 2012 at 8:43 AM

    Nice Post, many thanks. But how to bind the responder to the Access Gateway VServer?

  3. Jochen

    January 9, 2012 at 9:22 AM

    @Jochen
    Got it! Just add a Content Switching VServer to the same Access GAteway VServer IP but w/ Port 80 and bind the responder policy to the CS VServer. That’s it!

  4. Scott Barnwell@http://uk.linkedin.com/in/scottbarnwell

    February 6, 2012 at 5:35 AM

    Another good post. If anyone is looking for more information on binding the responder globally or to a VServer, here is the Citrix eDoc:

    http://support.citrix.com/proddocs/topic/netscaler-responder-93/ns-resp-binding-resppoli-tsk.html

    To globally bind a responder policy by using the configuration utility

    In the navigation pane, expand Responder, and then click Policies.
    On the Responder Policies page, select a responder policy, and then click Policy Manager.
    In the Responder Policy Manager dialog box Bind Points menu, select Default Global.
    Click Insert Policy to insert a new row and display a drop-down list of all unbound responder policies.
    Click one of the policies on the list. That policy is inserted into the list of globally bound responder policies.
    Click Apply Changes.
    Click Close. A message appears in the status bar, stating that the configuration has been successfully completed.

    To bind a responder policy to a specific virtual server by using the configuration utility

    In the navigation pane, expand Load Balancing, and then click Virtual Servers.
    On the Load Balancing Virtual Servers page, select the virtual server to which you want to bind the responder policy, and then click Open.
    In the Configure Virtual Server (Load Balancing) dialog box, select the Policies tab, which displays a list of all policies configured on your NetScaler appliance.
    Select the check box next to the name of the policy you want to bind to this virtual server.
    Click OK. A message appears in the status bar, stating that the configuration has been successfully completed.

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

Apache

How to properly use SSL redirects without getting certificate error messages

Today I would like to go over proper URL redirection when using SSL but first I would like to preface this by describing what...

January 6, 2011

Citrix Workspace

How to use FIDO2 security keys remotely inside a virtual desktop session hundreds of miles away using Citrix HDX USB redirection and Microsoft Azure AD

You can use FIDO2 hardware security keys plugged into your physical desktop over the Citrix HDX remoting protocol for use with virtualized Windows Desktop...

January 6, 2011

Exchange 2003

Microsoft Exchange 2003 spam filtering made easy

A useful Exchange 2003 guide I wrote for a friend’s blog originally but I am posting it here on mine now for your viewing...

January 6, 2011

Cloud Design Architecture

Community-driven book available now! Byte-Sized: Cloud design principles and architectural recommendations

The community-driven paperback book initiated by my friends Bas van Kaam and Christiaan Brinkhoff is available for sale on Amazon. If you haven’t picked...

January 6, 2011

JasonSamuel.com began in 2008 as a way for me to give back to the IT community. This website features the latest news and how-to's on enterprise mobility, security, virtualization, cloud architecture, and other technologies I work with. This website has evolved over time to become a go-to reference hub for these technologies. It receives hundreds of thousands of unique visitors from all over the world each month. More details on the About Me page.
Copyright © 2008-2023 JasonSamuel.com

Exit mobile version