In ZTCM, if I have a Session policy for StoreFront LB that uses for reasons an IP address and the only connections to that specific LB come from the NetScaler itself. Is there a way to still enable ZTCM for that LB? There are some knobs in the SSL Profile that are tempting...

SNI HTTP Host Match

- this likely doesn't help as it reads the HTTP request host header

Allow Unknown SNI

- likely candidate, but how the certificate is then determined for the vServer?

Drop requests for SNI enabled SSL sessions if host header is absent

- disabling this in combination with the one above looks like something to try? ... or, would it be simplest just to add the DNS name as an addRec in the NetScaler DNS and then switch to use names? Would this resolve the issue?

If it is referenced directly from the netscaler can't you just use an internal domain certificate? ZTCM is mainly for those external certificates

that would cover this specific use-case, but what about the GSLB environments, where the StoreFront BaseURL is also GSLB'd?