Citrix documentation explains that to secure traffic between internal components (StoreFront ↔ Delivery Controllers), the administrator should enable HTTPS communication using internal domain-issued SSL certificates.
Why Domain SSL Certificates are correct:
Domain-issued certificates are trusted automatically by all domain-joined machines.
They cost nothing because they are issued by the company’s internal Certificate Authority (CA).
They secure communication between:
StoreFront servers
Delivery Controllers
They protect internal usernames, passwords, STA tickets, and XML communication without requiring public certification.
Thus, deploying:
✔ A domain SSL certificate on StoreFront
✔ A domain SSL certificate on Delivery Controllers
provides full internal encryption at minimal cost and minimal administrative effort.
Why the other options are incorrect:
Third-party SSL certificates (A and B) cost money, require external verification, and provide no additional benefit for internal-only communication.
Citrix documentation recommends third-party certificates only when externally exposed components (e.g., Citrix Gateway) must be trusted on unmanaged devices.
Documentation References
StoreFront Security Configuration → HTTPS and Certificate Requirements
Delivery Controller XML/HTTPS Configuration Guide
Citrix Virtual Apps and Desktops Security Hardening Guide
Submit