Linux Citrix Receiver : SSL error 4

[jesse varela]

Hi,

 

My company recently started using Citrix. I run Linux on my laptop and the Citrix Receiver is horrible to use on Linux. (Fedora 27).

 

First it was a SSL 61 error.

    Manually had to download and install some certificates.

 

Now it is a SSL 4 error.

   cannot figure this one out. Some say that it is TLS vs SSL fight somewhere in the connection. ( I do not know much about networking)

 

Version 13.4 seems to work but it has its own issues. I noticed that the Windows and Mac OS versions are more updated and seem to be better supported. I do not have an issue running the Citrix Receiver on Windows 10. Only on Fedora 27. (have not tried other operating systems).

 

Will Linux support ever be treated like a first class citizen?

 

Is this SSL 4 error Linux specific?

 

Any help is appreciated.

 

 

[Dominik Mierzejewski]

13.9 seems to have fixed the SSL Error 4 issue for many people. Have you tried it yet?

[jesse varela]

The fact that 13.4 works with Linux but anything above it does not, makes me feel like it is just broken.

 

What is it about the Linux installation that is not working?

 

I really dislike Windows after trying Fedora(Linux). It is just smoother, I worry less about crashes and instability. Enterprise servers trust this OS to run for their stability  and I think as a desktop user, that is what I need. Enterprise grade stability, but not if vendors will not support it. 

 

I hope that Citrix can figure out or find a way to make the Linux experience smoother with their products. I realize that Linux Users represent a very small portion of the desktop user population but I really do feel that we need something that works here with Linux.

 

Thanks

[Valeri Bonchev]

Hello,

 

The issue you are running into is purely an OS level issue. It has to do with the certificate repository that is provided with the OS. Windows has always been ahead of the curb on that front as Microsoft pushes the CA certificates and updates them on a regular basis through Windows update. 

 

To resolve the issue you have to ensure that the CA's that issued the certificates are trusted ( having to install the certificates on the Linux machines manually) or you can use a cert from a CA that is in the certificate repository included with the distribution of Linux. The below link outlines which CAs and ciphers  are supported out of the box by Linux Receiver. 

 

https://docs.citrix.com/en-us/receiver/linux/current-release/secure.html 

 

The section of the forum that you posted your question is for NetScaler Secure Web Gateway - which is a web proxy type of product. For greater exposure. Use the NetScaler Gateway of Receiver sections. Below is a link to the Receiver for section of the forum. 

 

https://discussions.citrix.com/forum/169-receivers-and-plug-ins/ 

 

Val 

[CarlStalhood]

I moved this thread to the Linux Receiver forum.

[jesse varela]

Hi,

 

Thanks to both of you for your assistance.

 

However, I went online to search for the certificates. However, the SSL Error 4 is still there. 

 

Any ideas? Anyway to pinpoint why the SSL Error 4 is coming out?

 

thanks

[jesse varela]

Val,

 

Any ideas on where I can find the Certificates that will satisfy the SSL Error 4?

 

Is there a place to download these certificates from? I went through the links you provided before, but I either missed it or did not see a place to download the certificates from.

 

Any help is appreciated.

 

thanks

[Valeri Bonchev]

What I was referring to is that you will need to obtain a certificate from one of the CAs on the list. Otherwise you will have to install the CA certs on each end point and ensure that they are trusted. 

 

Val 

[jesse varela]

I cannot install certificates on my employer's servers/system.

 

What can I do from my desktop side to get this to work using Linux OS. Some suggested going to the site and downloading the certificate from there, which I did and it got rid of the SSL ERROR 61. However, it does not seem to help with the SSL Error 4.

 

This error only occurs on Linux - Fedora 27.

 

I know very little about certificates and how all this works.

 

thanks.

 

[Paul Whittaker]

See the epic https://discussions.citrix.com/topic/385459-ssl-error-with-135-works-with-134/ thread.  Citrix made some change related to SSL ciphers in 13.5 that broke older XA/XD/Netscaler deployments.  One problem was provably related to use of the "Secure ICA" option (see the equally epic https://discussions.citrix.com/topic/385408-receiver-135-keyboard-no-longer-working/ thread), but AFAIK that particular issue was fixed in 13.6.  However, many people are still reporting SSL-related issues when using >= 13.5, the only 100% reliable solution I'm aware of is to downgrade to 13.4.  Upgrading XA/XD/Netscaler to a later version will probably help if you're in a position to do that.

 

FYI there was a private 13.4.1 release that fixed certain bugs in 13.4, that you might be able to convince Citrix to share with you if 13.4 is problematic.

 

[Paul Whittaker]

See the epic https://discussions.citrix.com/topic/385459-ssl-error-with-135-works-with-134/ thread.  Citrix made some change related to SSL ciphers in 13.5 that broke access to older XA/XD/Netscaler deployments.  One problem was provably related to use of the "Secure ICA" option, but I think that particular issue was fixed in 13.6(?).  However, many people are still reporting SSL-related issues when using >= 13.5, the only 100% reliable solution I'm aware of is to downgrade to 13.4.  Upgrading XA/XD/Netscaler to a later version will probably help if you're in a position to do that.

 

FYI there was a private 13.4.1 release that fixed certain bugs in 13.4, which you might be able to convince Citrix to share with you if 13.4 is problematic.

 

[jesse varela]

On 3/22/2018 at 10:26 AM, Dominik Mierzejewski said:

13.9 seems to have fixed the SSL Error 4 issue for many people. Have you tried it yet?

I did finally get it to install.

 

I used chrome to download it this time and a few updates came down for fedora. Somewhere along the way, the right dependency was installed and I was able to install this client through the fedora Software Center. It worked a expected.

 

Good job to you all.

 

It does need some work for hidpi support (my laptop is hidpi but it scales my remote desktop to the same size but does not adjust the scaling on it to make it usable. So my remote desktop ends up being too small....different issue so I will open another ticket. ).

 

Thanks all! I am back to using Fedora Linux!!!! You all are amazing!

 

 

[Temp Account You Can Delete this Account]

Hi, I had the same error. The real underlying error for "SSL error 4" is the following:

 

/var/log/citrix/ICAClient.log:

<P94504> citrix-wfica: SSLconnect enter: cs=0x3c1aaa80, context=0x3c113800

<P94504> citrix-wfica: Negotiation failed. sslretcode: 61

 

This means a certificate error. You can fix it with sym links of the certificates of Firefox:

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts

Solution fetched from: https://en.code-bude.net/2017/05/03/how-to-fix-ssl-error-61-in-citrix-web-receiver-on-linux/