This message was deleted.

dready: Yes I have. It's in the /wfs/ca-certs folder too. PEM format

so you don't get a cert warning when browsing to the storefront web on the iz2?

2048 keysize

might want to try to remove the ca cert via UMS and re-deploy (via remove from and copy file to tc)

@Steve Elgan Is that sha1 maybe?

Yea so it does work via the browser just fine

nasty!

latest firmware in use?

bypass the Netscaler to go right to SF and same issue

sha256 working for us

are you deploying your cert as Common, Web, SSL, or Undefined with root perms?

as web

and do your users connect to SF via native receiver or via browser?

no perm settings available for this type afaik

ok yea so we are trying to do native receiver

latest sf?

we tried appliance mode but since we are SHD and apps that doesn't work so great

ok there are issues with launch of published apps with native receiver but only with 7.14 i thought

but yea if we connect via browser it works wonderfully

have you tried different receiver versions?

yes

hmm strange

13.4.2

so must be some issue with the root cert. just guessing

yea just not sure what. IGel docs are real specific except that it has to be PEM format

you don't have intermediate ca probably

we do not have one

that might be a difference to GD

could be

@Steve Elgan so i have some more quick checks on the internal certs. I am wondering if we switch to (common certificate-all purpose), if that makes a difference. According to IGEL now, everything will be going that way with them as the way they symlink, the 'common cert' classification is more of a catch all everywhere in the file system rather than web browser. Did we test that yet. Also, do me a favor and setup an A record in DNS for IGELRMSERVER to point to the UMS server as i just found out it tries to query that initial when getting 'files|certs' transferred before timing out. so now on this other thing where i am having a bit of a different issue with a timing thing where it gets the internal certs sometimes after a little bit. Then we can try also type of common certs. I noticed that type offiicially creates teh ca-certs directory whereas web browser does not create that directory. Web browser certs should show up in /wfs/user/ when they get to the thin client which i KNOW for sure is where the firefox browser is looking to. But we were good on that with the browser so native receiver must be looking somewhere else... Certs--- the death of us all

roger ozzy. We have tried the common cert. trying your suggestions now

im testing out your scenario now with my other environment with native SF access instead of appliance mode - difference is i have intermediate internal cert here so worth confirming

Thanks. Yea I read that the other day. The dir is already made and the symlinks are working too. /tc/ssl/certs and /opt/Citrix/ICAClient/keystore/ca-certs both have the root CA cert present.