This message was deleted.

Second error message:

that article is very vague and unclear, but what they want you to do is have the 444 gateway reachable from the internet, and have your ICA file point to the 444 gateway, so that flow is not prompted for any certificate prompt. That's why they enter the 444 address in SF, so that the sslproxyhost in the ICA file gets populated with the nonclient cert address. See it as literally another gateway on another port that does pure ICA proxy in stead of authentication.

Thanks for the feedback Lucas! I also thought about this but can't believe that also the port 444 has to be reachable through the NAT from the internet. Will try this and give some feedback - by the way wat a shit solution from citrix...

I have had this running for years for belgian eid authentication at customers, usually use a second ip and port 443 though, to make sure for compatibility, 444 is frequently blocked on some private / public networks.

It's a nfactor config. Usercert and Password or Password and Token