Citrix already pulled SecureICA once and broke user access, and even though it works again it is still deprecated and waiting to be removed, so if you keep it in your policies it is time to plan the move to Secure HDX before the vendor does it for you.

for some reason i thought SecureHDX and the VDA TLS/DTLS configuration were the same, but they are not. Make sure to confirm your workspace clients and infra are at the supported versions