This message was deleted.

For MAC and Linux the Root and Intermediate CA needs to be linked to the cert on the Netscaler. On Windows this works automatically

They are already.

Windows CWA only supports user certificates on smart card. I suspect Mac has the same restriction.

Is ica only set to on or off on your Citrix gateway?

ICA only is set to on. Thanks@Carl Stalhood, but if I click on OK, I have the choice to "Sign in with another method" and then it prompts the certificate window and I am able to authenticate successfully.

I assume you're referring to the VDA login. In that case, you can use FAS to SSON to the VDA.

I think NFactor with certs is only supported for the web login, not for the native WorkspaceApp.