Determines whether or not additional checks are carried out during a TLS handshake when validating an X.509 certificate received from the peer. Settings apply as follows: YES - (1) During certificate verification, ignore the Common Name field (inside the subject name) if Subject Alternative Name X.509 extension is present in the certificate for backend connection. (2) Verify the Extended Key Usage X.509 extension server/client leaf certificate received over the wire is consistent with the peer's role. (applicable for frontend and backend connections) (3) Verify the Basic Constraint CA field set to TRUE for non-leaf certificates. (applicable for frontend, backend connections and CAs bound to the Citrix ADC. NO - (1) Verify the Common Name field (inside the subject name) irrespective of Subject Alternative Name X.509 extension. (2) Ignore the Extended Key Usage X.509 extension for server/client leaf certificate. (3) Do not verify the Basic Constraint CA true flag for non-leaf certificates.
Default value = NO.
Possible Values : YES, NO.