Citrix ssl error 61 linux

Thread: citrix connect getting ssl error 61

Thread Tools

Display

citrix connect getting ssl error 61

I installed the new citrix client ICAClient-11.0-1.i386.rpm on 11.1, and when connecting to sites i receive client errors. «you have not chosen to trust «thwate premium server ca» the issues of the server security certificate ( ssl error 61).

I went into fire fox and under view certificates i find the cert mention under the certificate manager, the authorities tab.

Not sure how to chose to trust. I would assume if it is listed if should be trusted.

any help is appreciated.

Re: citrix connect getting ssl error 61

I figured out the issue with ICAClient connection getting the (ssl error 61). I figured I would post the solution in case someone else runs into the same ssue in the future.

The solution to the issue was as follows:

Now if you get this error, the ssl certificate is missing from the ICAClinet folder /usr/lib/ICAClient/keystore/cacerts. To fix this issue you can go into firefox → Edit → preferences → Advanced → view certificates → authorities tab → then find the certificate that is missing and export to your local folder.

Once you have export the certificate to your local folder you will need to copy the export certificate to the /usr/lib/ICAClient/keystore/cacerts folder from a window that has root permissions. So, SU and perform the copy.

For this example I exported the file to my download folder:

# cp /home/kkare/download/* /usr/lib/ICAClient/keystore/cacerts

Now that the certificate is in the ICAClient folder you will now be able to run the client and connect.

Re: citrix connect getting ssl error 61

Thanks! You really helped me out!

Re: citrix connect getting ssl error 61

update for Citrix Receiver for Linux 12.1: the certificate file now needs copied to /opt/Citrix/ICAClent/keystore/cacerts/

Re: citrix connect getting ssl error 61

I figured out the issue with ICAClient connection getting the (ssl error 61). I figured I would post the solution in case someone else runs into the same ssue in the future.

The solution to the issue was as follows:

Now if you get this error, the ssl certificate is missing from the ICAClinet folder /usr/lib/ICAClient/keystore/cacerts. To fix this issue you can go into firefox → Edit → preferences → Advanced → view certificates → authorities tab → then find the certificate that is missing and export to your local folder.

Once you have export the certificate to your local folder you will need to copy the export certificate to the /usr/lib/ICAClient/keystore/cacerts folder from a window that has root permissions. So, SU and perform the copy.

For this example I exported the file to my download folder:

# cp /home/kkare/download/* /usr/lib/ICAClient/keystore/cacerts

Now that the certificate is in the ICAClient folder you will now be able to run the client and connect.

Источник

The Anti-Kyte

Oracle – for when it was like that when you got there

You have chosen not to trust… – Citrix Receiver and SSL error 61 on Ubuntu

After months of trouble-free operation, Citrix Receiver decided to wreak some havoc one morning last week.
Connecting to work (using Firefox on Ubuntu and Citrix Receiver for Linux 13.8) was trouble free as usual.
However, when I then tried to select a PC to remote into, Citrix informed me that …

“You have chosen not to trust Entrust Root Certification Authority – G2. SSL error 61”

At that point, I reflected that what I knew about Citrix and SSL certificates would fit on the back of a fag packet.
After some intensive “research” it should now fit into a short blog post…

Citrix Receiver for Linux has a bug…again

A quick internet search lead me to the Citrix Support site.
Their advice ( perhaps understandably), was to upgrade Citrix Receiver to the latest version.
After some fiddling around – steps for installing on Ubuntu can be found here if you’re interested, I had the latest version.
Now, I’m not sure whether it’s just an unfortunate coincidence or whether I’ve upset the good people at Citrix, but it seems that whenever I install the latest version, there is a Linux specific bug.
So, after about half an hour of messing about, I was back where I started with the same error and the same version of Citrix Receiver.

Attempting to connect via Chrome gave exactly the same result.

Re-installing my certificates

Re-reading the error message, I noticed that it was a specific certificate that was the problem.
Running a search, I was able to confirm that the said certificate is available from Entrust.

Once I’d downloaded the certificate in question, it was simply a matter of putting it where Citrix Receiver could see it.
So…

Magically, Citrix Receiver was happy again and I was able to connect.

Some points to note for next time

A colleague of mine had the same issue. He is running Debian.
His solution was to :

– delete the files in the Citrix Receiver certs directory :

– create a symlink in the directory from the certificates in

If you’re reading this because you have a similar problem and the first solution doesn’t work, then perhaps this may be worth a try ( backup the certificate files before deleting them though !)
I’m still not sure of the root cause of this issue, although I suspect it may be something to do with browser updates.
On the plus side I’ve avoided having to drag myself into the office…for now.

Share this:

Like this:

34 thoughts on “ You have chosen not to trust… – Citrix Receiver and SSL error 61 on Ubuntu ”

I’ve just installed Citrix Workspace on a Raspberry Pi 4 running Rasbian and it works a treat after I downloaded the G2 cert that was missing thanks to your article.

Bless you! This was brilliant! It never occurred to me to use the certs already on the file system. That works!

I stumbled upon this and this fixed my citrix problem when my company ‘help desk’ said they could not help me any further. Thank you so much.

Thank you! It worked for me too. I just downloaded and applied the certificate. Presto!

Thank you. It worked for me on Ubuntu 19.10 desktop.

Thank you, Thank you, Thank you.

Thanks.
It works. I just added the symbolic link of the Entrust*G2 cert to Citrix keystore directory. Then the error disappeareded
TM

I searched for some hours before finding your excellent advice. Thank you .. It worked.

Very helpful – you saved me lots of hours 🙂

Thank you very much. Here’s the only working article!

This was very helpful, thanks.

Thanks!this solved the SSL error , but now I’m getting the error connection to “IP address” lost please check your network and try again,when trying to connect to a remote desktop from my receiver. The same works fine from windows though, any idea why is it happening?

Ritika,
assuming that you’re observing this behaviour when using the same browser (e.g. Chrome) on Windows and Linux then I’d suggest that you check to see if you have the same browser version on each OS. If so, then check the configuration for any differences and finally – if all else fails – try clearing the cache.
If none of that does the trick then it may be worth checking to see if the Linux version of Citrix Receiver that you are running has any known bugs.

Thanks! Will try this out

Thanks a lot!! This worked

Copying ‘entrust_g2_ca.cer’ didn’t work for me – but copying my certs files into cacerts did the trick!

Thanks for the help! How I wish I didn’t have to use this awful piece of software…

I feel the same, citrix is awful. This worked for me. Thanks everyone 👏👏

Thank you very much!, i’m using debian 10 and the simbolik link was the idel solution for me.

I am using debian 9 can you put down steps here

The commands bellow was successful for me:

cd /opt/Citrix/ICAClient/keystore
ln -s /etc/ssl/certs .

OMG THANKS. I had to go to Entrust and get the cert file and place it in my ICAClient folder and viola, it works!

Have been struggling with this for months as I tried to make Linux Mint my daily driver. Copying the entrust file worked! Thank you!

an absolute legend

Copying certs from /etc/ssl/certs to /opt/Citrix/ICAClient/keystore/cacerts/ worked for me on Zorin (Ubuntu 18.04-based).

Solved it for me to, although mine was the “digicert global root g2”. Great post, thank you.

Wow, it works! Thank you very much! I spent many hours unsuccessfully looking for a solution to the problem. Thanks again

Thanks for the info, I was actually able to fix my issue another way with the info you gave in the post. I simply found the certificate I needed in /etc/ssl/certs/ and copied the source of that symlink. Then I copied the source file into /opt/Citrix/ICAClient/keystore/cacerts/ and no more errors — and newly working Citrix apps.

thanks for sharing your solution.
I’m sure that others landing here will find it useful !

On August 2018 the Citrix Receiver was replaced by the Citrix Workspace App, the latest version can be downloaded from https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html

The solutions in this thread made the Citrix “light” or “web” version work for me. However, to fix the “full” version I took the following similar actions:
Downloaded http://www.tbs-x509.com/USERTrustRSAAAACertificateServices.crt (from https://www.tbs-certificates.co.uk/FAQ/en/USERTrustRSAAAACertificateServices.html).
Moved it into /opt/Citrix/ICAClient/keystore/cacerts/

Worked right away, not even a restart needed.

I hate to ask as I’m no expert and can barely even follow the solutions above–but, will this solution work on an iMac (Big Sur OS, latest versions of Chrome, Safari and Firefox)? Is this a server only thing, or a local computer solution?

I have a mystery here that no one at my help desk or on the internet seems to know the answer to.

My issue: I use my iMac to remote in to my work PC (Windows 10, have no idea what servers my company uses). It’s worked great for the past 3 or so years. Last week, my remote access via Citrix Workplace ceased working. I had made no other changes at that time, but coincidentally my company had implemented requirement to log in with MS Authenticator. (Which I also have and use, previously for other company access points) I tried updating the Citrix Wordplace app, and then just doing the basic Citrix receiver web access, too. I’ve restarted about 25 times. Either way, I get an error “You have not chosen to trust ‘Entrust Root Certification Authority – G2’. Contact your help desk.” Or, it says “Cannot connect to server.”

I DO HAVE the Entrust Root Certification Authority – G2 installed in my iMac keychain. I have it set to “Always Trust” and all my system and browser settings otherwise match my MacBook air–which strangely DOES allow me to access Citrix and remote in. So, what the what. (And I really cannot keep working on a 13″ laptop screen 8 hours a day)

I’ve read the Citrix support posts related to this issue. I’ve gone to the Entrust website where they say to download a new cert version–which they don’t actually have posted and available for download….

My help desk experts–as incredibly patient and tenacious as they’ve been–have not solved the issue. So, I’m scouring the internet for any shred of help I can find. Sometimes, I send what I find to the help desk folks, which I’m sure is offensive, but I’m desperate. At this point, I feel like that one patient who annoys their doctor with self-diagnoses from WebMD.

All of the commenters here sound like they’ve found the holy grail of help! Anyone know how I can fix this issue?

Apologies for the absurdly long post. Thank you for reading!

With the caveat that I am not a Mac user…

What springs to mind is the following ( with apologies for listing stuff you’ve probably already tried and already know).

First, this is a local computer solution – when you get the “you have chosen not to trust” message, Citrix is talking about a file on your local machine.
This is independent of the browser being used ( or was in my case).

The “Entrust Root Certification Authority – G2” thingy is an SSL certificate.
These have an expiry date after which they are not valid. So it’s possible that the version of this certificate on your machine has expired and you need to get the up-to-date one.
This may explain why Citrix suddenly decided it didn’t like it.
So, I guess the first thing might be to try and get hold of the current version of the certificate and add it to the keychain ?
The download page that I found is at :
https://www.entrust.com/resources/certificate-solutions/tools/root-certificate-downloads

I’m hoping that if you click the Download link on the “Root Certificate” line under “Entrust Root Certificate Authority (G2)” you’ll get the file downloaded.

I have no idea how to add this cert to a Mac keychain, but this link may help :
https://support.apple.com/en-gb/guide/keychain-access/kyca2431/mac

If you manage to do all of that and it still doesn’t work, then I’d speculate that maybe Citrix is looking somewhere other than the keychain for the certificate.
If you search your machine for a file with the same name as the certificate file you downloaded, then you may find it in places other than the downloads directory or wherever the keychain keeps it.
If you do, then it may be worth copying the downloaded file to all of these locations as well ( having first backed up the files that are currently there).

I hope that some of this is of use.

Thanks very much for looking into this and spending the time to reply! The version of the cert at the Entrust website is unfortunately not the right release date—I’m uncertain why they’d still have it posted there. So, I was hesitant to download it and go through the install process and keychain update in case it mucked up other stuff on my Mac. However, good news (for me!), my support people finally came through and got this resolved. I should have posted a follow up here but was so excited it was working again that I forgot!

In case this can help anyone else, this is what fixed it for me: Previously, I had deleted and reinstalled the Citrix app several times, after backing up my files and then updating my OS. The solution my support desk finally suggested was so simple, it’s embarrassing. I had deleted the Citrix application files (and then deleted them from Trash), thinking this would clear the cert issue and provide a fresh slate, but I never ran an actual “uninstall” of the app. Once I deleted the files but then also ran the uninstall THEN ran a truly fresh new install of Citrix, it worked as expected. Yeah, embarrassingly simple fix. *face palm*

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Источник