0

I'm having a problem. I installed Citrix receiver icaclient 13.1.0.285639 in a machine running Ubuntu 14.04 LTS. I'm attempting to access my Citrix applications, but I get the following error:

`You have not chosen to trust 'RapidSSL CA', the issuer of the server's security certificate (SSL error 61).`

I have read multiple sites about how I can move the Mozilla certificates to the Citrix folder and attempted the proposed solution, however the problem persists. Currently I also have a Windows machine working perfectly with the server. Is there a way I can download the certificates from the Windows machine and install them in the Ubuntu machine?

Thanks!

1

3 Answers 3

4

I've had this exact same issue with 13.4 and ubuntu 16.10

A lot of the answers I've found are nearly correct, but this worked for me after reading this guide: https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/citrix-receiver/linux-oem-guide-13-1.pdf

sudo cp /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts/

sudo rename 's/\.crt/\.pem/' /opt/Citrix/ICAClient/keystore/cacerts/*.crt

sudo /opt/Citrix/ICAClient/util/ctx_rehash
2
  • WORKED. Thanks a lot. Accept this answer, please.
    – Vik
    Aug 14, 2017 at 2:23
  • This was key to fixing this in 2023. :) You can link the files like in the other answer, but you need to rename them.
    – Pepijn
    Jan 20, 2023 at 15:10
4

You don't need to get them from Windows, Firefox has the certificates you need, so you can use them: e.g.

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts/

sudo c_rehash /opt/Citrix/ICAClient/keystore/cacerts

I've argued this point with Citrix, but they seem to view the Linux version of the client as a tool for creators of thin client machines, and not as something that an actual user might install.

7
  • Thanks for your reply. I attempted the commands above, but my problem still persists. It continues with the exact same error. It's stupid from Citrix to believe that the Linux version would only be used by creators.
    – javy888
    Aug 26, 2015 at 14:29
  • The solution above is detailed in several places, including this document:- help.ubuntu.com/community/CitrixICAClientHowTo Aug 27, 2015 at 15:12
  • I have pasted my full notepad for installing Citrix Client on 64 bit Ubuntu here:- pastebin.com/waEzY0nw Aug 27, 2015 at 15:26
  • I attempted all the instructions in the notepad, everything installed correctly, I moved the certificates from mozilla Firefox to the client's folder. However, the error persists. This is frustrating!
    – javy888
    Sep 8, 2015 at 14:22
  • I have noticed that you are using a rapidSSL certificate, not the verisign G5 certificate that is usually the issue, I wonder if perhaps this is a different certificate that you could get hold of and copy into the /opt/Citrix/ICAClient/keystore/cacerts folder as well as the Firefox ones. Sep 8, 2015 at 14:38
0

I had similar problem (with icaclient 13.0) under Ubuntu 14.04 LTS. Like javy666, regardless what I did with certificates, I was still getting this error. I have installed them correctly into /opt/Citrix/ICAClient/keystore/cacerts, then I did the rehash with "c_rehash /opt/Citrix/ICAClient/keystore/cacerts", I have also updated directories /etc/ssl/certs/ and /usr/share/ca-certificates/mozilla/ and run update-ca-certificates. Google advised a lot of things that did not help, the same error message still persisted. Then I found out that the problem in my case was that my icaclient did not support SHA256 certificates (it did not support any SHA-2 certificates). The message is unfortunately very misleading, it is probably re-used for multiple different situations. I found out that newer version of icaclient (13.3) supports SHA-2 keys, so upgrading of icaclient solved the problem.

It might not solve all the occurrences of this error, but at least some of them.

The reason why this may appear just now more frequently is that SHA-1 are not very secure so logically servers migrate to new SHA-2 certificates, which have poor support in slightly older ICA clients and this produces this misleading error. In my case, our company upgraded intermediate certificates to SHA256, unfortunately at the same time they disabled HTML5 client (probably for compatibility reasons related to SHA256), so Citrix was suddenly completely broken in Linux.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .