Citrix NetScaler / Storefront / XenApp Certficate knowledge?

[Bruce123]

We have recently encountered a problem with our remote access service for staff. This is facilitated through Citrix Netscaler, 2x Storefront, 10x XenApp servers.

 

The internal certificate expired on the 2 Storefront servers, we produced a new certificate using MS CA and installed this onto the two Storefront servers (with private key). We also noticed that this certificate was installed on the Netscaler, so replaced it on there as well.

 

Remote access still isn't working (the web client just hangs after entering username/password). The Netscaler log shows errors which seem to indicate a problem with Monitor Service Binding and failure probing the two Storefront servers using SSL (see end of post).

 

It also, shows the Service Group XD_WISF_SVCGRP_X.X.X.102 (SSL) as down, when it should be up.

 

I checked the two Storefront servers and they appeared to have (the same) two issues each;

 

1) Keys need regeneration, and

2) And they each report not being bound to any SSL certificate

 

Following advise in Citrix KBs 1) I regenerated the keys and for 2) I bound the new SSL cert to the website in IIS. This seems to resolve the two issues as reported in Storefront management mmc, but now the Storefront servers are reporting "No Stores on this server. Click Create store to begin" and the internal thin clients are now unable to connect to the Storefront servers.

 

The Netscaler communicates to backend servers (i.e. Storefront servers) using SSL, but the thin-clients connect without SSL, so I don't know whether binding the SSL cert to the website forced SSL, nor not?

 

Does anyone have any thoughts on this issue or any help is greatly appreciated.

 

Kind Regards,

 

Bruce.

 

Replaced first 3 octets of IP with X.X.X.

 

MonServiceBinding_X.X.X.109:443_(XD_SF_MON_X.X.X.102)(XD_WISF_SVCGRP_X.X.X.102?X.X.X.109?443): DOWN; Last response: Failure - Probe failed. Wed Aug 30 10:20:35 2017

1373 0 PPE-0 MonServiceBinding_X.X.X.108:443_(XD_SF_MON_X.X.X.102)(XD_WISF_SVCGRP_X.X.X.102?X.X.X.108?443): DOWN; Last response: Failure - Probe failed. Wed Aug 30 10:20:35 2017

seqno rtime event-message event-time

1374 0 PPE-0 MonServiceBinding_X.X.X.121:80_(XA_MON_X.X.X.102)(XA_SECONDARY_BROKER_X.X.X.102?X.X.X.121?80): DOWN; Last response: Failure - TicketTag not found in the response. Wed Aug 30 10:20:35 2017

1375 0 PPE-0 MonServiceBinding_X.X.X.120:80_(XA_MON_X.X.X.102)(XA_PRIMARY_BROKER_X.X.X.102?X.X.X.120?80): DOWN; Last response: Failure - TicketTag not found in the response. Wed Aug 30 10:20:35 2017

1376 0 PPE-0 MonServiceBinding_X.X.X.122:80_(XA_MON_X.X.X.102)(XA_SECONDARY_BROKER_X.X.X.102?X.X.X.122?80): DOWN; Last response: Failure - TicketTag not found in the response. Wed Aug 30 10:20:35 2017

1377 0 PPE-0 MonServiceBinding_X.X.X.123:80_(XA_MON_X.X.X.102)(XA_SECONDARY_BROKER_X.X.X.102?X.X.X.123?80): DOWN; Last response: Failure - TicketTag not found in the response. Wed Aug 30 10:20:35 2017

1378 854 PPE-0 'server_serviceGroup_NSSVC_SSL_X.X.X.109:443(XD_WISF_SVCGRP_X.X.X.102?X.X.X.109?443)' Out Of Service Wed Aug 30 10:34:50 2017

1379 7 PPE-0 'server_serviceGroup_NSSVC_SSL_X.X.X.109:443(XD_WISF_SVCGRP_X.X.X.102?X.X.X.109?443)' DOWN Wed Aug 30 10:34:55 2017

1380 7 PPE-0 MonServiceBinding_X.X.X.109:443_(XD_SF_MON_X.X.X.102)(XD_WISF_SVCGRP_X.X.X.102?X.X.X.109?443): DOWN; Last response: Failure - Probe failed. Wed Aug 30 10:35:05 2017

Done.

[Davit2005]

From my memory a few years ago the Thin Clients are configured to look at the StoreFront whilst the External access is via the NetScalers.

 

If you have support for the Citrix Solution my first stop would be with them. They shouldn't charge for such a thing as installing new certs TBH.

[john]

@Ric_ maybe able to shed some help on it as he's a Storefront / XenApp / Netscaler guru