Customers who viewed this article also viewed
CTX274587
{{tooltipText}}
Article
|
Configuration
|
{{likeCount}} found this helpful
|
Created:
{{articleFormattedCreatedDate}}
|
Modified:
{{articleFormattedModifiedDate}}
Applicable Products
- Citrix Cloud
- Citrix Virtual Desktops
- Citrix Virtual Apps
- Citrix Virtual Apps and Desktops
Symptoms or Error
Application launch fails with SSL error 70: The server returned an expired security certificate
Solution
Install the AddTrust External CA certificate on the Cloud Connector servers
Problem Cause
Issue was seen on 30th May 2020 when the global certificate for AddTrust External CA expire
Was this page helpful?
Thank you!
Sorry to hear that.
Please provide
{{ feedbackPageLabel.toLowerCase() }} feedback.
Please provide article feedback
Feel free to give us additional feedback!
What can we do to improve this page?
Email address is required
Failed
to load featured products content, Please
try again
.
Posted by SaaaS 2017-07-25T15:07:08Z
Hello All,
based on testing,
My certificate has expired and I understand what needs to be done to get it fixed. The only thing is it will take about another day or so.
I wanted to know if there is any immediate local fix that I can perform on my computer to bypass this error ?
Maybe a registry key ?
3 Replies
-
I’m not aware of an over ride as such whilst your expired cert is bound to your gateway/storefront server.
You may be able to generate a self signed certificate through Active Directory Certificate Services or through IIS / Netscaler and bind that instead, however any internal / external clients connecting to this service must trust the certificate and have the appropriate intermediate/root certs on the certificate store otherwise you will be back to square one.
Was this post helpful?
thumb_up
thumb_down
-
Im aware of that, I was doing some research and saw that we can manipulate the registry key to bypass that error. I didnt get further in it and needed some guidance
Was this post helpful?
thumb_up
thumb_down
-
The only reg key I am aware of is the one to allow citrix receiver to communicate over HTTP, but that only takes effect when your going through the initial setup as far as I am aware.
https:/ Opens a new window
/ support.citrix.com/ article/ CTX134341
Was this post helpful?
thumb_up
thumb_down
As you may be able to determine from the previous post, I had some excitement while working with a NetScaler last week. Before I experienced SSL Error 38, I had to fix an SSL 70 Error when launching a published application from the Access Gateway site.
In this case, the error had nothing to do with the NetScaler but the resolution required a change to the computer on which I was connecting from. In this example, I was attempting to run an application while connected with an IE 8 browser. I opened IE properties and when to the Content tab and then clicked on Certificates.
Sure enough, there were several Verisign certificates that had expired on 1/7/2004, but the fix was easy enough. I had to install the Update for Root Certificates that can be downloaded as part of Windows Updates or downloaded and installed manually.
If you have any additional problems after applying the root certificate update, it may be necessary to click on the Clear SSL state button found within IE properties on the Content tab.
Generally
In nearly all cases, using the Native client is recommended over the Java client. See the section Changing the client for instructions.
To check/change the current client, click on the Advanced Options link on the login screen. Under “Remote client type”, the Native client should be currently selected.
Many issues are resolved by confirming that the local computer’s system clock is correct, deleting temporary internet files, and/or uninstalling then reinstalling the Citrix client. The Beyond site should be added to the Trusted Sites list in IE (see below).
Note that connecting to a user’s computer via a Webex support session installs a WebEx Document Loader virtual printer on that computer and sets it as the default printer.
Client installation issues
The latest Citrix client software can be downloaded from http://www.citrix.com/site/SS/downloads/index.asp.
Some older versions can be downloaded with fewer clicks from //ardamis.com/2009/11/26/citrix-xenapp-web-plugins/.
The wrong client software has been installed
Opening Citrix causes a window to open asking “What is the address of the server hosting your published resources.” There is a space to fill in the server name. The sample answer is https://servername
Uninstall and reinstall the Citrix client. Only the web plugin component should be installed.
Issues at the Citrix login page
Error messages to do with ‘invalid credentials’
This error is typically caused by an incorrectly typed password, PIN, or keyfob number; a domain password out of sync with the Novell password; or a keyfob in next tokencode mode.
Client software not detected
Before the user authenticates at the Citrix login page, the following warning is displayed in the Message Center:
We are unable to detect the appropriate client software on your computer to allow you to launch your applications.
Click here to obtain the client software
If the IE yellow warning bar is visible, click on it to install the Citrix Helper Control (an Active X control). Otherwise, if the software has been installed, click on the “Click here to obtain the client software” link, then click on either the Allow button or yellow bar to install the Citrix Helper Control, or click on the “Already Installed” link.
Adding the Beyond site to the Trusted Sites list in IE should allow the Active X control to run without prompting (see below).
Issues after successfully authenticating at the Citrix login web page
IE Trusted Sites
The user is able to authenticate at the Citrix login page and the applications are available, but the user sees the following warning in the Message Center:
Current browser security restrictions may prevent you from launching applications, or may require your explicit permission to proceed. To launch an application successfully, save the launch file if prompted and double-click the file to start the application.
This message appears only in Internet Explorer. Firefox and Chrome do not produce the warning. If the user is able to connect to the applications, the message can be ignored.
If the user is unable to connect, the resolution is to add the site to the Trusted Sites list in Internet Explorer:
In Internet Explorer, navigate to https://.com
Click Tools -> Internet Options -> Security tab.
Click the Trusted Sites checkmark icon, then click the Sites button.
Confirm that the URL https://.com appears in the top box, and click the Add button. Click Close and OK to return to the login screen.
Log in.
Client software not detected
The user is able to authenticate at the Citrix login page. Instead of a page displaying the available applications, the user sees a page displaying with the following warning:
Download Client Software
We are unable to detect the appropriate client software on your computer to allow you to launch your applications.
If you wish to download and deploy the client software to allow you to launch your applications, click Download.
If the IE yellow warning bar is visible, click on it to install the Citrix Helper Control (an Active X control). Otherwise, click on the ‘Already Installed’ link under Troubleshooting Options at the right-hand side of the page.
Temporary internet files
The user is prompted to save the launch.ica file. If the user saves the file and double-clicks it, Citrix opens but then displays an error:
The Citrix SSL server is not accepting connections.
Try clearing the browser’s temporary internet files. If this doesn’t resolve the issue, follow the instructions for adding the site to IE’s Trusted Sites, above. (Strangely, the resolution in a few tickets is to reboot the router.)
Client installation
The user is able to authenticate at the Citrix login page. After clicking on an application, the user receives the error:
Connecting through Citrix secured gateway. Error reading from proxy server.
Uninstall and reinstall the Citrix client. Only the web plugin component should be installed.
Session reconnection
The user is able to authenticate at the Citrix login page. After clicking on an application, the user receives the error:
There are no existing applications available for reconnection.
This is simply an informational message stating there are no pre-existing apps to reconnect to. It can be ignored if the user is not having an issue launching applications.
MSLicensing registry key
The user is able to authenticate at the Citrix login page. After clicking on an application, the user receives one of the following errors:
There is no route to the specified subnet address.
or
The Citrix MetaFrame server is not available. Please try again later.
To resolve, delete the MSLicensing registry key.
Click on the Start button, select Run and type in “regedit”.
Click OK.
The registry editor window will open.
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing.
Click once on MSLicensing so it is highlighted and then hit the Delete key.
Close the registry editor and attempt to login to Citrix.
Issues at the Novell Client window
Connecting to the wrong application
The user receives the following error message in Citrix after entering a username and password at the Novell Client window:
The system could not log you into the network.
Make sure your name and connection information are correct, then type your password again.
The user is likely trying to connect to the wrong application. For example, a Chicago user may have clicked on the DC Desktop application.
Issues after successfully authenticating at the Novell Client window
Reconnecting to a session
The user receives the following error message in Citrix after successfully authenticating at the Novell Client window:
Connection error: You have not been granted access to this published application
This issue can be resolved by a Citrix administrator. It may be due to an issue with a prior ‘disconnected’ session not connecting correctly. The administrator can reset the session.
Printer unavailable issues
The user cannot find the local printer in the list of available printers.
Disconnect from Citrix, set the local printer to be the default printer, confirm that the Native Client is the selected Citrix client under Advance Options, and reconnect to Citrix. If the printer is still missing, uninstall and reinstall the Citrix client.
Printer offline issues
While connected to Citrix, the user receives periodic messages having to do with ‘a network printer is offline’.
Check the physical printer. It is likely jammed or out of paper. It may also be that the printer is set to accept only certain paper types or sizes.
Confirm that the printer driver in Citrix is correct for that model printer.
Print jobs are not processed
In Citrix, a single print spooler is shared by all connections. A large print job can delay all other jobs, or a stuck job may prevent any other jobs from being processed. After ruling out other causes, contact the Citrix administrator to resolve.
MacPac
The user receives various errors when using MacPac.
If the user’s H: drive user folder is missing a \MacPac\Personal\ folder, copy yours to the user’s folder.
Lag
Latency is the primary cause of poor performance in Citrix. Latency can be roughly measured by pinging the URL of the login server. Latency greater than 100ms will result in lag and other problems. An example of lag is when the user types in a Word document but the text doesn’t appear on the screen for a few moments, then catches up all at once.
Citrix window not responding
Shortly (and sometimes immediately) after authenticating at the Novell Client window, the Citrix window will stop responding.
The fix is to give the user full rights to the MSLicensing key.
Open Regedit and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSLicensing
Right-click on the MSLicensing key and select Permissions.
Under the Security tab, click on Users to highlight it.
Check the box in the Allow column next to Full Control.
Click OK and close Regedit.
Accessing the local machine’s hard drive
Once in Citrix, right-click on the Start button in the Citrix environment and select Explore.
Browse the list of drives in the left-hand pane and locate “C$ on ‘Client’ (C:)“. This is the local workstation’s C: drive. Click on the drive to open it.
How to allow Citrix access to the local machine’s hard drive and USB devices (including printers)
The first time you connect to Citrix, you’ll be shown a ICA Client File Security setting window where you can choose what access to your local machine you wish to grant to Citrix. You are also able to choose to “Never ask me again”.
If you need to later change these settings, follow the appropriate steps below (try the ‘newer clients’ step first).
Newer clients:
While connected to Citrix, double-click on the Citrix Connection Center icon in the system tray of the local machine. Click on the Security icon to configure the Session Security options for Files, Microphones/Webcams, PDA Devices, and USB/Other Devices.
Older clients:
Disconnect from Citrix. On the local machine, delete the webica.ini file under C:\Documents and Settings\[username]\Application Data\ICAClient. When you next reconnect to Citrix, you’ll be shown the ICA Client File Security setting window again.
Citrix Program Neighborhood
How to minimize the Citrix window to view the local machine’s desktop.
Shift+F2
SSL Errors
SSL error 61 (the server certificate received is not trusted)
Run Windows Updates and update the root certificates.
SSL error 68 (the SSL certificate is not yet valid)
Set the local system clock to the current date and time.
SSL error 70 (the SSL certificate is no longer valid)
Set the local system clock to the current date and time.
SSL/TLS error: The certificate validation failed.
Confirm that the Native client, not the Java client, is in use by clicking on the Advanced Options link on the login screen.
http://support.citrix.com/article/CTX125056
Changing the client
Changing the client from Java to Native resolves a good number of connection problems. The only time the Java client is preferable is when OS X 10.6.6 is used with a particular release of the Mac Citrix Client and the local default printer is not available in Citrix.
To change the client, at the Citrix web interface login screen, click on the Advanced Options link below the Passcode field. The area below the Advanced Options link will expand.
(Click any of the thumbnails below to see the full-sized image.)
The Advanced Options area
Click on the link Click here to change the selected client. You’ll be taken to the Client Selection page. If the Native Client shows a status of Not detected, click on Deploy to the right of Native Client.
The Client Selection page
If the Native client cannot be detected by the browser, but you’re certain it has been installed, click on the Already Installed link at the right of the Client Detection and Download page. If there’s any doubt that the latest client is installed, click on Download and install the Citrix Online Web plugin.
The Client Detection and Download page
You may be returned to the Client Selection page. Once the Native Client has been deployed, choose it from the Default Client menu and click OK.
Return to the web interface login page and confirm that the Native Client is listed as the currently selected client under Advanced Options, then log in normally.