Use TLS SNI to hide your servers (incl. Citrix) from IP-based mass exploitation

The piece argues that SNI enforcement can make internet-facing Citrix NetScaler appliances less visible to automated, IP-based mass exploitation. It describes several 2026 vulnerabilities exploited before Citrix disclosed them, including two critical flaws used for up to three weeks and another exploited before its bulletin. In incident-response cases, attackers scanned address ranges and sent exploits to any appliance that responded like a NetScaler. By default, a NetScaler may complete TLS handshakes even when a client connects directly by IP or supplies an incorrect hostname, revealing its certificate and the domain it serves.

The recommended fix is to require the correct hostname in the TLS ClientHello. On NetScaler, this means enabling SNI enforcement, binding certificates only as SNI certificates, rejecting unknown SNI, and requiring the HTTP Host header to match the SNI. Without a matching hostname, the connection receives no certificate and fails; an optional ClientHello policy can instead reset the connection, concealing even the TLS behavior. The guidance includes configuration steps for profile mode and a legacy-mode alternative, and warns that one ordinary, non-SNI certificate binding can undermine the protection. The authors tested the behavior on NetScaler versions 13.0-90.7 and 14.1-73.30, and recommend verifying the result with the open-source tool SNItch. A key limitation is that Certificate Transparency logs can expose hostnames, so the approach is stronger when paired with a new, non-obvious hostname and a wildcard certificate.