This message was deleted.

If I enable TLS 1.0 it works

I have only TLS1.2 and 1.3 enabled on the NS LB for SF

I plan on upgrading my lab soon and will post back what I see.

It's about the Gateway vServer you use for Storefront and the callback URL. This doesn't work anymore without enabling TLS 1.0 and the Default ciphers. Second thing is the XML service, doesn't work either with SSL.

It's working here 🙂

And the XML service runs on SSL?

Hang on, you may have a point. I have been looking a my SF LB VIP, not my Gateway vServer

13.0 Build 84 (not the latest)

13.1.4.43 here

Same issus in my site upgrade to 2203. But NS 12.1

Disabled TLS1.0 and now I get a "Cannot complete your request" during logon

That's exactly the problem!

@Dennis @Marc-Alexander Gräber do either of you have a support case open by any chance?

We have all our GW vServers configured for A+ on SSLLabs. That's unacceptable from Citrix to enable TLS 1.0.

@Miguel Contreras thats my next step.

@Dennis it shouldn't require TLS1.0. Quite the opposite, actually. It shouldn't work with TLS1.0

Not yet, I plan to open a case tomorrow.

Something is definitely not right, so need to get this looked at

Only with TLS 1.0 ENABLED on the vServer it works.

Once one of you guys opens a case, if you don't mind, please share the case number. I'll reach out to the engineering team to help analyze the issue

Sure

Thanks, guys

Thats kind of funny. Some weeks ago i recommended my customer to bind the SSL profile for A+ everywhere but not on the Callback VIP for compatibility reasons. There have been similar problems before some years ago where Windows Server Updates caused the TLS handshake to fail (It was on LDAPs when i remember correctly)

Have posted in the Citrix discussion but the following Reg has allowed my StoreFront to talk TLS to XML/Gateway again using system TLS rather than .Net 4.5 defaults.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001

Great work @Aaron O'Reilly I'll test the registry changes in my lab setup ASAP

Yea, for sure. I had to do this with other products (non Citrix) but never with Citrix related. But good to know for sure.

But why is it needed now with 2203? It wasn't a requirement with earlier versions of StoreFront

Yea I agree, something changed in the .net code

I have only tested on WS2022, but as I understand it it's also an issue on WS2019?

I will test this immediately with my customer!

Which OS @Dennis?

2022 german

@Aaron O'Reilly are you using WS2019 or WS2022?

WS2019 english as well. I will also test it soon.

GREAT!!! It works with the mentioned registry change, XML and STA with SSL > no problem! THANK YOU @Aaron O'Reilly

For me also! Thx @Aaron O'Reilly

Looks like the web.config workaround from Citrix effectively tells StoreFront to use .Net 4.7 which itself already uses the system TLS defaults, so the reg fix I used just tells .Net 4.5 to do the same thing globally as per MS best practise in https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls That being said the web.config fix is probably best as with a new StoreFront 2203 deployment the web.config is explicitly set to 4.7 already, and it looks like a StoreFront upgrade just neglects to make this change from 4.5 to 4.7 in the existing web.config files.