Ошибка ssl 61 citrix linux

After months of trouble-free operation, Citrix Receiver decided to wreak some havoc one morning last week.
Connecting to work (using Firefox on Ubuntu and Citrix Receiver for Linux 13.8) was trouble free as usual.
However, when I then tried to select a PC to remote into, Citrix informed me that …

“You have chosen not to trust Entrust Root Certification Authority – G2. SSL error 61”

At that point, I reflected that what I knew about Citrix and SSL certificates would fit on the back of a fag packet.
After some intensive “research” it should now fit into a short blog post…

Citrix Receiver for Linux has a bug…again

A quick internet search lead me to the Citrix Support site.
Their advice ( perhaps understandably), was to upgrade Citrix Receiver to the latest version.
After some fiddling around – steps for installing on Ubuntu can be found here if you’re interested, I had the latest version.
Now, I’m not sure whether it’s just an unfortunate coincidence or whether I’ve upset the good people at Citrix, but it seems that whenever I install the latest version, there is a Linux specific bug.
So, after about half an hour of messing about, I was back where I started with the same error and the same version of Citrix Receiver.

Attempting to connect via Chrome gave exactly the same result.

Re-installing my certificates

Re-reading the error message, I noticed that it was a specific certificate that was the problem.
Running a search, I was able to confirm that the said certificate is available from Entrust.

Once I’d downloaded the certificate in question, it was simply a matter of putting it where Citrix Receiver could see it.
So…

sudo cp entrust_g2_ca.cer /opt/Citrix/ICAClient/keystore/cacerts/.

Magically, Citrix Receiver was happy again and I was able to connect.

Some points to note for next time

A colleague of mine had the same issue. He is running Debian.
His solution was to :

– delete the files in the Citrix Receiver certs directory :

/opt/Citrix/ICAClient/keystore/cacerts/

– create a symlink in the directory from the certificates in

/etc/ssl/certs

If you’re reading this because you have a similar problem and the first solution doesn’t work, then perhaps this may be worth a try ( backup the certificate files before deleting them though !)
I’m still not sure of the root cause of this issue, although I suspect it may be something to do with browser updates.
On the plus side I’ve avoided having to drag myself into the office…for now.

There are a lot of SSL errors out there.
Way too much, right?

You as a sysadmin know that for sure – Certificate Errors, Configuration Errors, Server Errors, Protocol Errors, and others.

Here you’ll find a list of the most common xxxxx errors and proven quick fix solutions:

And you’ll find the solution to get rid of ALL SSL errors – forever: Test PRTG as your new monitoring tool and get stared within minutes!

1. SSL error

«ssl_error_no_cypher_overlap»

Quick fix

Did you receive the error message “ssl error no cypher overlap” while using Firefox or another web browser? Then you are dealing with one of the most common SSL errors. The cypher overlap error occurs due to a misconfiguration of the TLS/SSL settings.

The SSL error can easily be solved by adjusting the settings in your browser. If you are using Mozilla Firefox, access the settings page and choose the add-on section. Check the add-on list for any extensions that you did not install yourself. Deactivate all unnecessary add-ons and plug-ins, then restart the browser.

You can also reset both the TLS and the SSL settings. In your brower, type about:config to open the settings. Type TLS in the search box and look through the TLS settings. If there are any modified settings, restore them back to default. Repeat these steps to reset the SSL settings as well.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

2. SSL error

«ssl_error_rx_record_too_long»

Quick fix

The common SSL error “ssl error rx record too long” may occur in your browser when visiting a website via HTTPS. The error is often accompanied by the error message “SSL received a record that exceeded the maximum permissible length” or a similar message. This means that the web server is sending HTTP data instead of HTTPS data.

This common SSL issue is usually caused by an error in the SSL implementation on the server itself. There are several things that you can do to solve the problem:

1. Ensure that SSL is configured correctly on the server.
2. Check if your browser is using the same port as the web server. To use port 443, some servers such as Apache require a configuration first.
3. If you are using a proxy server, the error can show up as well. In this case, make sure that your local proxy is configured correctly.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

3. SSL error

«ssl_error_syscall»

Quick fix

Are you facing the error message “ssl error syscall”, there is a problem with your SSL configurations. This can be caused by a disabled proxy protocol which leads to a failed request of the SSL handshake.

To fix the problem, make sure that you enable the proxy protocol in the inbound traffic. Also check if TLS is properly configured in the web server, as a misconfiguration of the server may lead to this error as well.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

4. SSL error

«ssl_error_bad_cert_domain»

Quick fix

The error code “ssl error bad cert domain” and the error message “The certificate is only valid for the following names” is often experienced by users while trying to access their SSL encrypted website or network. The error code indicates that there is a configureation problem with the SSL certificate of the website. The SSL error is commonly reported by Firefox users, but may also occur in other browsers.

Depending on the individual cause of the error, try the following troubleshooting solutions:

1. If caused by an SSL misconfiguration of the website itself, the configuration needs to be adjusted by the website’s admin. If it is your website, make sure that your SSL certificate is active and switch to HTTPS.
2. In some cases, the browser’s cache and cookies may lead to an SSL error. If this is the case, you can simply solve the problem by clearing the cache in the settings.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

5. SSL error

«ssl_error_internal_error_alert»

Quick fix

SSL error code “internal error alert” is a common problem faced by users of Mozilla Firefox and other web browsers. The error message indicates that there is a problem with the secure SSL connection. It may be caused either by the SSL certificate or by the settings of your browser.

To fix the problem, try the following troubleshooting steps:

1. Make sure you are using a valid SSL certificate.
2. Update your browser to the latest version.
3. Disable unknown or unnecessary add-ons in the Firefox settings.
4. Ensure that HTTPS is set up correctly.
5. If the error persists after these steps, restart your browser.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

6. SSL error

“ssl error 31”

Quick fix

Are you facing Citrix client SSL error code 31? Then you are dealing with one of many SSL errors with Citrix. Error 31 can be caused by a variety of misconfigurations or outdated version of the service provider.

To solve the problem, make sure the SSL certificate is valid. Also update your service provider to the newest version to avoid problems with the compatibility. Also check if any corporate settings or your firewall is blocking the connection.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

7. SSL error

«ssl error 61”»

Quick fix

SSL error 61 is an error code regularly experienced by Citrix users. There are several error messages that can be displayed for receiver users when accessing Citrix StoreFront or web interface applications, such as:

“Cannot connect to the Citrix XenApp Server. SSL Error 61: You have not chosen to trust ‘Certificate Authority’, the issuer to the server’s security certificate.”

“The server certificate received is not trusted (SSL Error 61)”

“You app is not available. Try again later.”

As a system administrator, you can try the following solutions to get rid of SSL error 61:

1. Update to the latest receiver version, as older versions may not support SHA2 certificates.
2. Ensure that you have the required root certificate or intermediate certificate. You can download the certificates from your SSL certificate provider. If you use an antivirus software, make sure that your antivirus software trusts the SSL certificate.
3. Check if the server certificate is compliant with the instruction in RFC 3280 in terms of the Enhanced Key Usage field.

Proper fix

Switch to PRTG: PRTG uses the SSL Security Check Sensor and lets you use SSL to encrypt your own monitoring data. PRTG helps you secure data traffic and notifies you at once if the security rating changes.

Источник

Thread: Citrix and SSL Error 61

Thread Tools

Display

Citrix and SSL Error 61

I’m using Ubuntu 12.04 LTS (32bit) and the latest Linux version of Citrix Receiver. Whenever I try to connect to my work network through Citrix I get the error message below. As far as I can see it’s not true, I *am* trusting the issuer of the server’s security certificate. This error message, (with different issuers) is frequently mentioned on the net but I cannot get any of the many many solutions to work in my case. Any advice would be gratefully received.

SSL error : Contact your help desk with the following information: You have not chosen to trust «/C=US/ST=/L=/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority/CN=», the issuer of the server’s security certificate (SSL error 61).

Re: Citrix and SSL Error 61

I’m using Ubuntu 12.04 LTS (32bit) and the latest Linux version of Citrix Receiver. Whenever I try to connect to my work network through Citrix I get the error message below. As far as I can see it’s not true, I *am* trusting the issuer of the server’s security certificate. This error message, (with different issuers) is frequently mentioned on the net but I cannot get any of the many many solutions to work in my case. Any advice would be gratefully received.

SSL error : Contact your help desk with the following information: You have not chosen to trust «/C=US/ST=/L=/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority/CN=», the issuer of the server’s security certificate (SSL error 61).

This is actually straight from Ubuntu’s Citrix help page:

To prevent the following error when accessing remote sessions:

Citrix Receiver
SSL error
Contact your help desk with the following information:
You have not chosen to trust»/C=US/ST=/L=/O=Equifax/OU=Equifax Secure Certificate Authority/CN=», the issuer of the server’s security certificate ((SSL error 61).

Источник

Ssl error 61 you have

Every time I try to connect to my internal website from a Linux OS Thin Client I recieve the SSL error 61. Firefox is the only browser on the Thin Client. There are no issues connecting from Non-Linux systems on any browser including Firefox.

Error Below: SSL error Contact your help desk with the following information: You have not chosen to trust » Go Daddy Secure Certificate Authority — G2″, the issuer of the server’s security certificate (SSL error 61).

How do I fix this error? I have already tried installing the cert manually to the client.

Выбранное решение

Cor-el: This does solve the issue for SHA1 certs.

I have added the certificate to the Citrix DB. I finally found the issue after researching the forums of Citrix and other various sites.

This issue is the cert itself, we purchased a cert and uses SHA2, however the Linux Citrix Receiver does not support SHA2 at this point.

So the only resolution is to either Re-Key the cert to use SHA1 or wait for an update from Citrix.

Thank you both for your time.

Все ответы (6)

With Citrix? I do see threads on that on the web:

The discussion seems to be outside the scope of Firefox support, but it could be that I just don’t understand it very thoroughly.

It is connecting through a Citrix Receiver but that should be irreverent as the certs are installed through Firefox and are handled, and Firefox is the application displaying that the CA is not trusted.

I guess what I’m getting at is for some reason the CA is not trusted, how do I force Firefox to realize that the CA is trusted even though I have installed the Root cert already. I have contacted Citrix and they said this is not their issue, HP has no idea why. The last party I have not contacted is Firefox. Maybe I’m just grasping at straws here?

Источник

Ssl error 61 you have

Every time I try to connect to my internal website from a Linux OS Thin Client I recieve the SSL error 61. Firefox is the only browser on the Thin Client. There are no issues connecting from Non-Linux systems on any browser including Firefox.

Error Below: SSL error Contact your help desk with the following information: You have not chosen to trust » Go Daddy Secure Certificate Authority — G2″, the issuer of the server’s security certificate (SSL error 61).

How do I fix this error? I have already tried installing the cert manually to the client.

Chosen solution

Cor-el: This does solve the issue for SHA1 certs.

I have added the certificate to the Citrix DB. I finally found the issue after researching the forums of Citrix and other various sites.

This issue is the cert itself, we purchased a cert and uses SHA2, however the Linux Citrix Receiver does not support SHA2 at this point.

So the only resolution is to either Re-Key the cert to use SHA1 or wait for an update from Citrix.

Thank you both for your time.

With Citrix? I do see threads on that on the web:

The discussion seems to be outside the scope of Firefox support, but it could be that I just don’t understand it very thoroughly.

It is connecting through a Citrix Receiver but that should be irreverent as the certs are installed through Firefox and are handled, and Firefox is the application displaying that the CA is not trusted.

I guess what I’m getting at is for some reason the CA is not trusted, how do I force Firefox to realize that the CA is trusted even though I have installed the Root cert already. I have contacted Citrix and they said this is not their issue, HP has no idea why. The last party I have not contacted is Firefox. Maybe I’m just grasping at straws here?

Источник

How to fix SSL error 61 in Citrix Web Receiver on Linux

I admit, the title is quite specific and will certainly appeal to only a small readership. But anyone who is facing the problem will be, like me, grateful for a solution.

In particular, the problem is about the SSL error 61 in the Citrix (Web) receiver under Linux and how to fix it. Since I have been running almost exclusively under Kubuntu for several months, the Citrix Reiceiver also moved into the new Linux box. Unfortunately, no connection to systems could be established, since the receiver disconnected with the following error message.

SSL Error 61: You have not chosen to trust “Go Daddy Root Certificate Authority – G2”, the issuer to the server’s security certificate.

What does that tell us? The web receiver wants to check the certificate of the server while connecting, but fails because it does not know the root certificate or better said it does not trust it. Accordingly, you can actually use an arbitrary root authority in the error message, since the error message would raise up with every missing authority certificate.

Now there are two solutions. Either you get the missing certificates and insert them into the following directory:

Or you have Firefox installed… How does Firefox help us? Because the root certificates of Firefox can be shared with the Citrix receiver with only one command via symbolic links. The whole works as follows:

In this case, a symbolic link for each root certificate that the Firefox knows is created in the Citrix directory, so that it can participate. Now your SSL error 61 should be gone.

If, for whatever reason, you want to undo the changes, you can run the following two commands:

running ubuntu 22.10, this one worked for me
sudo ln -s /etc/ssl/certs/* /opt/Citrix/ICAClient/keystore/cacerts

thanks for pointing me in the right direction!

After trying numerous things, this was the solution that works.

Thanks so much LUKA

This even worked for my 22.04 release of Ubuntu. Thank you very much Luka

This even worked for my 22.04 release of Ubuntu.

Thank you very much Luka.

If anyone having the same issue still after this fix. Might want to check your keystore/cacerts isn’t stored elsewhere depending on where you installed the citrix client.

i.e. /home/user/ICAClient/* rather than /opt/citrix

need to link to the keystore that’s in use.

Hi,
Thank you for posting this, Saved my day.

I am still getting SSL error 61 message on my Ubuntu 20.04 desktop. WHen I type I get these error messages (see below). ANy ideas?

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts/

I get the following messages in Terminal:
ln: failed to create symbolic link ‘/opt/Citrix/ICAClient/keystore/cacerts/T-TeleSec_GlobalRoot_Class_2.crt’: File exists

Источник

by Theresa Miller

So, it was finally time to rollout SHA2 certificates for your Citrix environment.  After doing so, you test your applications by launching your favorite Citrix XenApp Application.  To your surprise, the application will not open and returns an SSL Error 61.  Now what, what can be done to fix this issue?

Check your Trust Root or Intermediate Certificate

One of the likely causes is that the PC you are working on is missing it’s Trusted Root or Intermediate Certificate.  Your certificate provider can let you know which certificate type they use.  How do we make sure these are in place? This can be done manually per PC as shown in the example below, or automated per the following Microsoft article (https://technet.microsoft.com/en-us/library/cc754841.aspx).  Here are the steps to update an individual PC using a Digicert root certificate.  Note that these steps would be similar for most certificate providers.

————————————————————————————————

Advertisement:

Monitor/Access your virtual servers, workstations & data using Citrix XenDesktop with 24×7 support and a 99.9% uptime guarantee through CloudDesktopOnline. To know more about QuickBooks Hosting on Citrix XenDesktop, visit Apps4Rent. 

————————————————————————————————

1) Open Internet Explorer go to https://www.digicert.com/digicert-root-certificates.htm

2) Download the Intermediate Certificate called “DigiCert SHA2 High Assurance Server CA” or the appropriate certificate for your environment and save your PC or a network location

3) Go to Start, Search from your Windows 7 workstation

4) Type MMC and press enter

5) From the menu select, Add/Remove SnapIn

6) Select Certificates and click “Add”, then click OK

7) Choose Computer Account and click Next

Choose Local Computer and click finish and click OK

9) Expand Intermediate Certificates and click on Certificates.

10) Right-click on Certificates, then selectAll Tasks, and click Import

11) Click Next on the Certificate Import Wizard

12) Click Browse and go to the location of the downloaded certificate and then click Next

[wp_ad_camp_1]

13) Click Next

14) Click Finish

15) Test the application to verify the SSL Error 61 error has gone away

If the error didn’t go away or if the certificates were already set the way that should have been, then the next stop is to look at  your version of Citrix Receiver.

Citrix Receiver

Updating to the latest Citrix Receiver version will typically resolve the issue once the certificates are in place.  Here is the link to Citrix Receiver for Windows http://www.citrix.com/go/receiver.html?posit=glnav, and here is the latest version for a MAC http://www.citrix.com/downloads/citrix-receiver/mac.html

Say Goodbye to SSL Error 61!

Недавно при использовании Citrix Receiver для подключения возникла проблема «Невозможно подключиться, Citrix Receiver (XenApp) SSL 61 Вы не выбрали доверять издателю сертификата …». Решил эту проблему, импортировав сертификат.

Во-первых, это явление описано в этом сообщении.https://tieba.baidu.com/p/5726814088 не могу подключиться к серверу. Обратитесь к системному администратору и укажите следующую ошибку: Ошибка SSL 61: вы не выбрали доверять издателю сертификата безопасности сервера «XX CA».

Это связано с тем, что, когда система использует канал Citrix SSL для связи, сертификат, предоставляемый сервером, не регистрируется клиентом Citrix Receiver, что приводит к сбою установления соединения.

Зная, что проблему решить легче. Сначала найдите этот сертификат, вы можете спросить у администратора, или вы можете экспортировать его из других мест, где этот сертификат доступен.

В Windows выберите меню «Пуск» в поле «Найти / выполнить» (вы также можете использовать клавиши Windows + R, чтобы открыть окно «Выполнить»), введите команду mmc и нажмите Enter.

Выберите файл меню -> добавить / удалить блок управления (M) …

Выберите «Сертификат» из доступных единиц управления слева и нажмите кнопку «Добавить».

Выберите «Учетная запись компьютера» и нажмите кнопку «Далее».

Выберите «Локальный компьютер» и нажмите кнопку «Готово».

Нажмите кнопку «Подтвердить»

В это время инициализируется консоль сертификата.

Наш сертификат обычно находится в сертификате промежуточного центра сертификации.

Вы можете выбрать имя, предложенное в приведенном выше отчете об ошибке, например это корневое агентство. Мы дважды щелкаем, чтобы открыть его на экспортированном компьютере, и открываем вкладку «Путь к сертификату», чтобы проверить действительность. Если это нормально, будет отображаться «Сертификат в порядке».

Выберите сертификат и нажмите контекстное меню, чтобы выбрать все задачи -> экспорт или выберите экспорт на панели операций.

Выберите формат сертификата, например двоичный, а затем выберите имя файла для его сохранения.

На другом компьютере импортируйте его таким же образом.

Следует отметить, что только самого центра сертификации при импорте недостаточно. Эмитенту необходимо соответственно экспортировать и импортировать.

Итак, используйте тот же метод для поиска издателя целевого сертификата. Например, можно найти «Сертификаты» в разделе «Доверенные корневые центры сертификации».

Также необходимо убедиться, что соответствующий сертификат организации также экспортируется и импортируется на компьютер, на котором работает Citrix Receiver.

На этом этапе вы можете видеть, что статус сертификата промежуточного центра сертификации, сообщившего об ошибке, уже имеет статус «с сертификатом нет проблем».

Для получения подробной информации обратитесь к этому шагуhttps://24x7itconnection.com/2015/03/10/you-can-fix-it-yes-you-can-citrix-xenapp-ssl-error-61/ 。

Официальные инструкции Microsoft здесь, но их труднее читать.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754841(v=ws.11)?redirectedfrom=MSDN

Если это версия Citrix Receiver для Linux, вы можете обратиться к следующей статье, использовать Firefox, чтобы найти соответствующий сертификат и экспортировать его в pem, затем использовать OpenSSL для преобразования в crt и, наконец, поместить его в cacerts хранилища ключей под ICAClient Citrix Receiver
https://www.cnblogs.com/kozmers/p/12346751.html

/opt/Citrix/ICAClient/keystore/cacerts$ sudo openssl x509 -in GlobalSignRootCA.crt -out GlobalSignRootCA.pem

sudo cp ~/tmp/cert/GlobalSignRootCA.crt /opt/Citrix/ICAClient/keystore/cacerts/