User Device certificates

[Chris Tyson1709156276]

We've logged this issue with citrix a couple of times and haven't been able to resolve so I'm posting here to see if anyone else has come across it.

 

We are using Certificate and domain authentication, XMS 10.10 (although previous versions had the same issue), MS certificate server on Windows Server 2016 as the credential provider with the certificate template configured as per the citrix guidelines and set to expire after five years. We have around 4000 users 99% using samsung android devices.

 

In the past 18 months our certificate server has issued over 400,000 user certificates - it appears to me as though either there is no checking to see if a certificate already exists or that process is broken.

 

Has anyone see anything similar?

[ArnaudP1]

3 minutes ago, Chris Tyson1709156276 said:

We've logged this issue with citrix a couple of times and haven't been able to resolve so I'm posting here to see if anyone else has come across it.

 

We are using Certificate and domain authentication, XMS 10.10 (although previous versions had the same issue), MS certificate server on Windows Server 2016 as the credential provider with the certificate template configured as per the citrix guidelines and set to expire after five years. We have around 4000 users 99% using samsung android devices.

 

In the past 18 months our certificate server has issued over 400,000 user certificates - it appears to me as though either there is no checking to see if a certificate already exists or that process is broken.

 

Has anyone see anything similar?

 

Hello, 

 

did you modify your certificate policy to just apply once?

By default it will apply on each connection

 

Thanks

Arnaud

[Chris Tyson1709156276]

Hi Arnaud,

Do you mean Device Policies - Credentials ? We have no device polices for certificates. As I understand it, the certificate is delivered via Settings - Netscaler Gateway - Deliver user certificate for authentication.

 

Thanks

 

[Ryan Tsamouris]

This may sound silly, but we had a very similar issue and it turned out someone was using the Deploy button on the entire Delivery Group, which does push the cert policies again by requesting new certs. By default though if the cert is already installed it shouldn't go request a new one.