I'm having some troubles getting citrix receiver (client agent, not web) working on ubuntu 16.04.1 LTS.

After initial install, I added Firefox' CA Certs to the cacerts folder in /opt/Citrix/ICAClient/keystore by using a symbolic link, followed by a rehash of the certs;

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts/
sudo c_rehash /opt/Citrix/ICAClient/keystore/cacerts/

This got citrix working if I go via the web browser. Apps launch and everything is A-OK.

I can't for the life of me get the receiver application to work though. When i try and add my company's store the client, it fails instantly with:

Your account cannot be added using this server address.
An SSL connection to the server couldn't be established because the server's certificate was not trusted.

The certificate we are using for Storefront (served via Citrix Netscaler gateway) is a wildcard issued by GoDaddy. Does anyone know whether or not I need to add this certificate in somewhere so Citrix Receiver client will work?

Any help would be greatly appreciated.



To resolve this issue, you can refer to the following links:

Secure - Citrix Product Documentation

How to convert .crt to .pem - Stack Overflow

I can get the receiver application to trust the server's certificate by the following steps:

  1. Export server certificate from the web browser. The certificate is exported in the file extension .crt. You may also find them in /usr/share/ca-certificates/mozilla/*
  2. Convert the crt file to a pem file by the following command:

    openssl x509 -in mycert.crt -out mycert.pem -outform PEM

    where mycert.crt is the exported certificate.

  3. Copy the pem file to $ICAROOT/keystore/cacerts

    Normally $ICAROOT=/opt/Citrix/ICAClient

  4. Rehash the certificate by the following command: $ICAROOT/util/ctx_rehash

  5. Reopen Citrix Receiver. It should trust the certificate now.
  • 2
    A note if the solution above doesn't work right away: I had to export and add every single certificate in the certificate chain before getting the receiver to work. In my case that was: 1. GoDaddyRoot... certificate, 2. GoDaddySecure... certificate, 3. my organization's certificate – Zack Mar 20 '19 at 0:25
  • Thanks Zack, that was my EXACT situation as well and these two suggestions combined resolved my issue. The specifics of those certs and the timing make me wonder if you are the Zack I've met at SA. Thanks for adding this comment either way. – Brian Jorden Apr 13 '19 at 16:16

Revert to Citrix Receiver (v13.4)

And then follow the steps from Chin-Chang Yang above..

Refer this link!

  • thx, Citrix sucks - I always had issues with new versions - going back to 13.4 solved those ones – laplasz Sep 24 '18 at 18:56

Always the case, as soon as I post a question I find an answer. I tracked this down by running

/opt/Citrix/ICAClient/util/configmgr &

In the shell I then found another error


There is a utility under /opt/Citrix/ICAClient/utils called ctx_rehash. Apparently c_rehash isn't sufficient and you have to use this one as well. After I ran that (sudo /opt/Citrix/ICAClient/utils/ctx_rehash) everything came good.



I still get an SSL Error 4 I can see a lot of certificates in /usr/share/ca-certificates/mozilla/* Which all certificates do I need to export.

Please elaborate

Export server certificate from the web browser. The certificate is exported in the file extension .crt. You may also find them in /usr/share/ca-certificates/mozilla/*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.