This message was deleted.

From which version did you do the upgrade? There has been a requirement since 1912 CU2 for Ciphers: To resolve this issue, the cipher suite order list on Citrix ADC must include only the TLS_ECDHE_* cipher suites. Assign a delivery controller server as STA Server in Citrix ADC or StoreFront outside your site. Also ensure that the cipher suite order list on StoreFront includes the cipher suites. These cipher suites must precede any other cipher suites. https://docs.citrix.com/en-us/storefront/current-release/whats-new/known-issues.html Don't know if that's configured in your lab?

StoreFront was 1912 CU3 and is on same Server 2022 box as controller so no ADC LB used for that.

No issues here. Brand new installed SF 2203 on WS2022, load-balanced via NS13.1.4.43. I have just logged on remotely via Azure AD auth to my on-prem lab-setup

Have posted in the Citrix discussion but the following Reg has allowed my StoreFront to talk TLS to XML/Gateway again using system TLS rather than .Net 4.5 defaults.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001

There is a solution for this issue: https://support.citrix.com/article/CTX399424

I can confirm this is working although the registry fix is way easier 🙂

You can force SSL settings with this handy ADMX template https://github.com/Crosse/SchannelGroupPolicy

I would recommend the change described in the article as it only targets StoreFront. If there is anything else ( any service running) relying on .NET and those settings in the registry it might mess something up.