SSL Error 61 when using Citrix Workspace on Windows AutoPilot Devices

[George Ly]

I'm having users getting the error message "SSL Error 61: You have not chosen to trust "Entrust Root Certification Authority - G2", the issuer of the server's security certificate....." when trying to launch applications from Citrix Gateway via Citrix Workspace App. The Citrix Workspace app was installed through Autopilot. However, the users are not having issues/error messages when launching applications when the computer is not Autopiloted. 

 

 

I have uninstalled Citrix Workspace and re-installed it from the Citrix website and still get the same error message. Something else that makes the issue more confusing is that it only happens on some Citrix Gateways. We are remotely accessing EMR system from several hospital systems. Some of the hospitals are launching fine, while others are providing users with this error. 

 

Any thoughts on the resolution? Sounds like the issue is with Autopilot, but if installing Citrix Workspace from Cirix.com is still causing the issue then I am out of ideas. 

[CarlStalhood]

In NetScaler, go to Traffic Management > SSL > Certificates > Server Certificates. Find the Gateway certificate. Right-click the Gateway certificate and click Link to link it to the Intermediate certificate for Entrust.

[George Ly]

12 minutes ago, Carl Stalhood1709151912 said:

In NetScaler, go to Traffic Management > SSL > Certificates > Server Certificates. Find the Gateway certificate. Right-click the Gateway certificate and click Link to link it to the Intermediate certificate for Entrust.

 

Would I need to have access to the hospitals' end of NetScaler to have access to the certificate? I am on the end user side of Netscaler and don't see anything that gives me those options in the instructions you provided above. 

[CarlStalhood]

Yes. The behavior you are seeing is usually because the certificate on the NetScaler is not linked to the intermediate.

[George Ly]

16 hours ago, Carl Stalhood1709151912 said:

Yes. The behavior you are seeing is usually because the certificate on the NetScaler is not linked to the intermediate.

 

That might be difficult to request that from all of our hospital partners (I assume they would need to do it on their on). However, this doesn't explain why the behavior doesn't occur on non-autopiloted computers at our organization. We only recently started issuing autopiloted computers and this error popped up at the same time. 

[CarlStalhood]

Windows machines (not Mac or Linux) normally download missing certificates from the Internet. I'm not sure where it's configurable.

[George Ly]

1 hour ago, Carl Stalhood1709151912 said:

Windows machines (not Mac or Linux) normally download missing certificates from the Internet. I'm not sure where it's configurable.

 

I assume the downloads go to some folder on the device? Most likely under the user's profile.  It is making me wonder if autopilot devices don't have the available folder/user does not have permission to write (download and save the missing certificate) in that folder.