SSL Offloading with Citrix Netscaler is not working when requesting PDF files

Question

we are working in one of our projects with Citrix Netscaler in front of our web site. we configured the Citrix Netscaler to use SSL offloading but when we request a PDF file the SSL offloading does not work properly. when browsing html pages it works fine. Is there any issue with the SSL offloading in Citrix Netscaler?

You'd need to give a bit more detail, which version of NetScaler OS? What do you mean by the SSL offloading does not work properly? — , Jan 12 '13 at 00:04

score 1 · Answer 1 · answered Jan 12 '13 at 00:54

Yes, agree with ImmL, insufficient information.

Most likely causes are:

"fast webview" enabled PDFs and the improbably stupid Acrobat/Acroread clients sending overly large HTTP "Range:" request headers which are dropped by the Netscaler. Proliferation of HTTP 206 responses in web server logs is a good indicator of this.
improbably stupid MSIE+Acrobat interaction whereby MSIE prevents HTTPS content from being saved to disk, appears to download the PDF file, then starts Acrobat plugin with a file that does not exist.

The server-side work-arounds are, respectively: 1. disable fast webview when creating PDFs, and/or increase HTTP header size limits 2. to allow PDF caching, set Cache-control: to remove "no-cache", add max-age=0; unset any Pragma: header. Or Save-As then Open PDF manually.

score 1 · Answer 2 · edited Jul 26 '18 at 19:00

I had the same problem. We configured SSL offloading for a web application and every html page loaded without problem, but "application/acrobat" content that should be sent to the client and rendered by the web browser always finished on a connection reset, so that content was not loaded.

We discovered that the "block HTTP invalid request" option was blocking that content. If we removed that option in the HTTP global parameters the PDF data could be rendered on the client web browser. It was not an option to disable the "block HTTP invalid request" parameter because we need it to protect the applications, so we investigate a little more to find the root cause that makes NetScaler to block that traffic.

We used the following shell command to see the stats of the blocking reasons:

root@ns# nsconmsg -g http_err_noreuse_ -d stats

Index reltime     counter-value symbol-name&device-no
    1  483000                 0 http_err_noreuse_multipart
    3       0                 0 http_err_noreuse_IncompleteHeader
    5       0                 0 http_err_noreuse_link_server
    7       0                 0 http_err_noreuse_large_data
    9       0                 0 http_err_noreuse_IncompleteChunk
   11       0                 0 http_err_noreuse_InvalidHeader
   13       0                 0 http_err_noreuse_ResponseBeforeData
   15       0                 0 http_err_noreuse_non_trackable_res
   17       0                 0 http_err_noreuse_http_0_9
   19       0                25 http_err_noreuse_morethanCtLen

We found that the reason to bloack the traffic was http_err_noreuse_morethanCtLen. This counter increments when the POST body is larger than the value provided in the request Content-Length header.

Searching and searching we found this article: https://support.citrix.com/article/CTX205113

It solves the error by enabling the option "erase extra data from server".

I hope my solution can help you.

SSL Offloading with Citrix Netscaler is not working when requesting PDF files

2 Answers2