To achieve end-to-end encryption while allowing the Citrix ADC to perform optimization (like caching, compression, or content switching), a configuration known as SSL Offloading with re-encryption is necessary.

1. An SSL protocol for the vServer terminates the client's encrypted session at the ADC. This decryption step is essential for the ADC to inspect the plaintext traffic and apply optimization policies.

2. An SSL protocol for the services is then used to re-encrypt the traffic before forwarding it to the backend servers. This ensures the data remains encrypted between the ADC and the backend, completing the end-to-end encryption path.

This combination secures the entire data path while unlocking the ADC's Layer 7 optimization capabilities.

A. HTTP protocol for the services: This option leaves the traffic between the ADC and the backend servers unencrypted, failing the end-to-end encryption requirement.

B. SSL bridge protocol for the vServer: In SSL bridging mode, the ADC does not decrypt the traffic; it passes the encrypted packets directly, thus preventing any optimization.

C. SSL bridge protocol for the services: "SSL bridge" is a virtual server configuration type, not a protocol that can be assigned to a backend service.

E. HTTP protocol for the vServer: This option leaves the traffic between the client and the ADC unencrypted, failing the end-to-end encryption requirement.

1. Citrix ADC 13.1 Product Documentation

"SSL offloading and acceleration": "In an SSL offloading deployment

the Citrix ADC appliance terminates the SSL connection from the client... To provide end-to-end encryption

the appliance can re-encrypt the data and establish an SSL session with the back-end server. For this configuration

you need an SSL virtual server on the appliance to receive encrypted traffic from clients

and an SSL service to send encrypted traffic to the server."

2. Citrix ADC 13.1 Product Documentation

"SSL bridging": "In some situations

you might not want the Citrix ADC appliance to decrypt the traffic... In this case

you can configure the Citrix ADC appliance to bridge the SSL traffic. The appliance does not perform any SSL acceleration

such as SSL offloading

or other CPU-intensive operations." This confirms that SSL bridging prevents optimization.

3. Citrix ADC 13.1 Product Documentation

"Configure services": This section details the configuration of services

including the protocol type. For encrypted communication to the backend

the protocol must be set to SSL. It states

"Protocol: Protocol that the service uses. For example

HTTP

TCP

or SSL."