Likes: 
After a certificate update on our Citrix farm we are having issues with the linux receivers. The webbrowsers of linux users are able to create a connection to the landing page after login. However: clicking on an application icon gives them "error 61: a certificate is not trusted".
We have tried with Citrix receiver 13.0 and 12.1, on Ubuntu 13.10 amd64. Before the certificate update everything worked smooth. The certificate update involves a new intermediate CA from "QuoVadis". We actually did copy the .crt file on Citrix Receiver 12 into the cacerts folder, or copy the .pem files and performed the rehash on Citrix Receiver 13 to get it trusted.
We even went so far as to delete all crt/pem and hashed files from cacerts, open the portal in firefox, export from the browser every single certificate up from the root (there is a root CA and two intermediate CA's before the webserver certificate is presented) into cacerts in .pem format, then run the rehash function. But that same error message comes up again.
We have tried to switch browsers, from Firefox to Google Chrome, no difference. Uninstalled the Citrix client, including all personal settings in .ICAClient, rebooted Linux, installed new Citrix client, rebooted Linux, installed certificates, performed rehash. But again no difference: the error message on the untrusted certificate stays.
We have also used wireshark to capture the traffic between the client and the citrix farm, to ensure that the correct certificates are used. Downloaded the certificates from the capture files as DER, converted them with openssl to PEM, installed in cacerts and run the rehash function. But the problem remains the same.
The problem started after we changed the third certificate in the chain (the intermediate CA) last friday. At first we had lots of issues, also with the windows receivers, but on all those workstations the problems disappeared when the client got removed and after a reboot reinstalled. Apparently that had something to do with the receiver not downloading the new intermediate CA certificate.
There are (as far as we are concerned) two things left, either:
- there is something wrong with the certificate (chain) which makes it validate on Windows, but not on Linux. But what could it be? None of the key lengths are above the 4096 bytes boundary of the Linux receiver;
- there is something wrong with the receiver and this 'something' is triggered by the certificate change. This all though the problem persists on both the Citrix receiver for Linux v12 and v13.
Could somebody test the certificate chain? The whole chain is downloadable as a pem file from here. Testing it with openssl gives the result "error 19 at 3 depth lookup:self signed certificate in certificate chain", which would be correct as that is the intermediate CA certificate?
Any help would be greatly appreciated. Tx!
Quote
