4

I'm having some troubles getting citrix receiver (client agent, not web) working on ubuntu 16.04.1 LTS.

After initial install, I added Firefox' CA Certs to the cacerts folder in /opt/Citrix/ICAClient/keystore by using a symbolic link, followed by a rehash of the certs;

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts/
sudo c_rehash /opt/Citrix/ICAClient/keystore/cacerts/

This got citrix working if I go via the web browser. Apps launch and everything is A-OK.

I can't for the life of me get the receiver application to work though. When i try and add my company's store the client, it fails instantly with: 

Your account cannot be added using this server address.
An SSL connection to the server couldn't be established because the server's certificate was not trusted.

The certificate we are using for Storefront (served via Citrix Netscaler gateway) is a wildcard issued by GoDaddy. Does anyone know whether or not I need to add this certificate in somewhere so Citrix Receiver client will work?

Any help would be greatly appreciated.

Cheers.

Improve this question

5 Answers 5

Reset to default
13

To resolve this issue, you can refer to the following links:

Secure - Citrix Product Documentation

How to convert .crt to .pem - Stack Overflow

I can get the receiver application to trust the server's certificate by the following steps:

  1. Export server certificate from the web browser. The certificate is exported in the file extension .crt. You may also find them in /usr/share/ca-certificates/mozilla/*

  2. Convert the crt file to a pem file by the following command:

    openssl x509 -in mycert.crt -out mycert.pem -outform PEM

    where mycert.crt is the exported certificate.

  3. Copy the pem file to $ICAROOT/keystore/cacerts

    Normally $ICAROOT=/opt/Citrix/ICAClient

  4. Rehash the certificate by the following command: $ICAROOT/util/ctx_rehash

  5. Reopen Citrix Receiver. It should trust the certificate now.
Improve this answer
2
  • 2
    A note if the solution above doesn't work right away: I had to export and add every single certificate in the certificate chain before getting the receiver to work. In my case that was: 1. GoDaddyRoot... certificate, 2. GoDaddySecure... certificate, 3. my organization's certificate
    – Zack
    Mar 20, 2019 at 0:25
  • Thanks Zack, that was my EXACT situation as well and these two suggestions combined resolved my issue. The specifics of those certs and the timing make me wonder if you are the Zack I've met at SA. Thanks for adding this comment either way.
    – Brian Jorden
    Apr 13, 2019 at 16:16
1

Revert to Citrix Receiver (v13.4)

And then follow the steps from Chin-Chang Yang above..

Refer this link!

Improve this answer
1
  • thx, Citrix sucks - I always had issues with new versions - going back to 13.4 solved those ones
    – laplasz
    Sep 24, 2018 at 18:56
0

Always the case, as soon as I post a question I find an answer. I tracked this down by running 

/opt/Citrix/ICAClient/util/configmgr &

In the shell I then found another error

Error adding store:AM_ERROR_HTTP_SERVER_CERTIFICATE_NOT_TRUSTED[65150]

There is a utility under /opt/Citrix/ICAClient/utils called ctx_rehash. Apparently c_rehash isn't sufficient and you have to use this one as well. After I ran that (sudo /opt/Citrix/ICAClient/utils/ctx_rehash) everything came good.

Cheers.

Improve this answer
0

I still get an SSL Error 4 I can see a lot of certificates in /usr/share/ca-certificates/mozilla/* Which all certificates do I need to export.

Please elaborate

Export server certificate from the web browser. The certificate is exported in the file extension .crt. You may also find them in /usr/share/ca-certificates/mozilla/*

Improve this answer
0

The other answers work, but I didn't know what "download the certificate" meant.

You need a server URL to connect to Citrix, something like yourorg.net. I'll use YOUR_SERVER_URL as a template.

1. Download server's certificate

   1.a. option from CLI

openssl s_client -connect [YOUR_SERVER_URL]:443 -showcerts </dev/null 2>/dev/null|openssl x509 -outform PEM > YOUR_SERVER_CERT.pem

  • You might get this error:

    40779AFE687F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../ssl/statem/extensions.c:893:

    Fix it by editing the following file with sudo

    sudo nano /etc/ssl/openssl.cnf

    Find this section and add the following:

    [openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1
Options = UnsafeLegacyRenegotiation

   1.b. Option from browser

  1. Open YOUR_SERVER_URL in Chrome.

  2. Click in the Lock icon to the right of the URL and then in the "certificate" link.

    enter image description here

    enter image description here

  3. Then click in the "Details" tab, and "Export" button.

    enter image description here

  4. Save as YOUR_SERVER_CERT.pem and you won't need to convert it to pem file.

2. Copy the certificate to Citrix client directory

sudo cp YOUR_SERVER_CERT.pem /opt/Citrix/ICAClient/keystore/cacerts/

3. Now update Citrix certificates with:

/opt/Citrix/ICAClient/utils/ctx_rehash
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.