Renew Citrix Security Certificate

[quaium]

Does anyone know how we install a renewed Citrix security certificate on to the CAG?

 

Users can login fine to our Citrix website but when they click on a desktop they get the following error message:

 

SSL Error 70: The server sent an expired security certificate

 

We have the renewed security certificate in a .cer format on one of the Citrix servers. Any help would be great.

[bigjb]

Through a web browser navigate to the IP address of the GAG http://:9001 and install the the Citrix Access Gateway Admin Tool. The SSL certificate is uploaded via this interface.

[quaium]

We already have the Citrix Access Gateway Admin Tool installed. Where do we go from there?

[CyberNerd]

IIRC You can add it in IIS management, default site

[CyberNerd]

you might also need to add it to the certificates mmc - under Local computer account>personal> certificates for the CAG to pick it up....

[bigjb]

Click on the Administration Tab in the admin tool and upload a crt signed certificate.

[CyberNerd]

Click on the Administration Tab in the admin tool and upload a crt signed certificate.

 

I think we must be using different versions - I'm CAG 3.2.0 and don't see Administration Tab at all.

[bigjb]

yep we are using 4.5.8.

[quaium]

Ok this is strange. I checked the mms console and it appears that the old certificate is in fact there. However, when i add the new certificate I don't get our website address in the "issued to" section like we previously had (instead I get Verisign appear). Is this normal?

 

The other thing is the old certificate only appears to show im the mms console and nowhere else. Not in IIS or on the Gateway Access Management console. Is this normal?

[CyberNerd]

I'm pretty sure that this is what I followed, then the certificate appeared in CAG

 

How To: Install and Configure Citrix Web Interface 4.6 and Citrix Secure Gateway on the same server (Part 1)

[wrights]

Citrix Secure Gateway is a Windows application, Citrix Access Gateway (CAG) is an appliance; the process for updating the SSL certificate differs.

 

The CAG's (new) certificate can be uploaded via a browser on port 9001, it must be in PEM format and have a password.

A PEM format file contains both a certificate and a key that relates to that certificate, you can produce such a file by exporting the certificate and key from a windows server using the certificate mmc snapin.

[wrights]

If you have a Linux server available then a PEM file can be created using OpenSSL.

 

What you actually need the mmc snapin or OpenSSL for is to password the key, if it is already passworded then copying and pasting the certificate and key into the same file will usually work fine.

The CAG will not accept the PEM file unless the key has a password.