SSL VDA connection issue to Remote PC

[dpalchu521]

Testing Remote PC and trying to setup HDX over SSL (encrypted VDA). Followed the steps to install cert and run script to enable SSL but unable to connect. 

 

The errors are:

 

 TdIca 1014   "The Citrix ICA Transport Driver received SSL initialization error 0x80090331." as well as

 

Schannel 36874                 "An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The TLS connection request has failed."

 

I tried setting cipher GPO as recommended here https://support.citrix.com/article/CTX232685 but that did not work. Unencrypted connections work fine.

 

The target I am testing is Win 10 1809. The netscaler is 11.1 56.19.

 

This happens in two environments I tested -  7.15 LTSR and 1903.

 

Any help will be appreciated.

 

Thanks!

[CarlStalhood]

Frontend is what you configure on the Virtual Server. Backend is based on the default_backend cipher group, which you can't modify. But if you enable the Default SSL Profile, then you can modify the default backend SSL profile. Modifying the Virtual Server has no impact on the backend.

[CarlStalhood]

Is your NetScaler a VPX?

 

Newer builds of NetScaler add TLS 1.2 ciphers to the default backend cipher group. Or you can enable the default SSL profile and adjust the backend ciphers yourself.  https://www.carlstalhood.com/ssl-virtual-servers-netscaler-12/#sslprofile

[dpalchu521]

The NS is VPX running on SDX. I tried it with default cipher group and preconfigured one (per some security page a while back). Does not seem to make a difference.

Is there a set of ciphers you recommend setting?

[CarlStalhood]

The issue is probably backend, not frontend. You can't really configure the default backend until you enable Default SSL Profile.

 

Go to Traffic Mgmt > SSL > Cipher Groups. Find the default_backend cipher group and see what ciphers are there. You probably won't see TLS 1.2 ciphers.

[dpalchu521]

That one does not, but I am using default on my gateway which has TLS 1.2. Should I switch to default_backend?

[dpalchu521]

I enabled default profile and configured backend to allow TLS 1.1 and 1.2.  Still getting same errors. Do I need to modify ciphers on backend profile?

[dpalchu521]

Got it! I switched the cipher group to High and got in.

 

This is awesome. THANKS CARL!

 

I did this on my test NS. Any consideration for prod change?