Citrix experiences, howto, tips n tricks

Linux ICA client

Encounter this in your firefox session?

Fear not, the web interface is completely firefox compatible, but then, when you want to start an application or remote desktop (XenApp or XenDesktop), you require specific software called "ICA Client".

• Download the ICA package on the citrix website: www.citrix.com > Downloads > Citrix Clients > Linux Clients > Version 11.100 .tar.gz
• Unpack it somewhere

  ~# tar xvzf linuxx86-11.100.158406.tar.gz

• Run the setupwfc shell script

  ~# ./setupwfc

  In case you wonder, as root or as user; this is a choice: as root the ICA client will be globally installed for all users, as user only for you.
• Choose the installation option: 1

  User install mode.
  
  Select a setup option:
  
  1. Install Citrix Receiver for Linux 11.100
  2. Remove Citrix Receiver for Linux 11.100
  3. Quit Citrix Receiver for Linux 11.100 setup
  
  Enter option number 1-3 [1]: 1
  

• Confirm the path (different when root or non-root)
• It will ask you a couple of questions, such as: Gnome and KDE Integration? Browser integration (Firefox)? Its up to you to decide, but the easiest is to "y" for everything
• The client is now installed, but there are some dependancies:
  • sudo apt-get install libmotif3
  • sudo apt-get install msttcorefonts
• If you try connecting now, you'll probably get:
  

  Untrusted SSL CA?

  The same thing goes here as within a regular browser, you have to trust the CA that created the webinterface certificate, otherwise it will not connect. The screen will no doubtably state for which CA you are missing the certificate. In this case "Register.com CA SSL Services (DV)".
• Import the CA certificate in the trusted keystore of the ICA Client. Now the recommended way for you to do this, is to acquire the CA certificate by googling (if it's on the internet) or bugging your administrator (if it's an internal CA). But the best way, if it's on the internet, is to extract all CA certificates in the middle of your server's certificate and import them all. Use this website: Networking4All Site Check. It will By changing the "?fqdn" parameter in the URL you can query any SSL site for all certificates (example: www.tumblr.com). It will show you all certs like this:
  

  The entire SSL Certificate Chain

  How intresting. These are all the certificates in the chain in PEM/DER format. Luckily our ICA client understands this. So copy paste the following part in a new file:

  -----BEGIN CERTIFICATE-----
  MIIEsjCCA5qgAwIBAgIQWFEaYfNA0hbn/PY5JInR5DANBgkqhkiG9w0BAQUFADCB
  lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
  Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho
  dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt
  SGFyZHdhcmUwHhcNMDgwNzEwMDAwMDAwWhcNMjAwNTMwMTA0ODM4WjBQMQswCQYD
  VQQGEwJVUzEVMBMGA1UEChMMUmVnaXN0ZXIuY29tMSowKAYDVQQDEyFSZWdpc3Rl
  ci5jb20gQ0EgU1NMIFNlcnZpY2VzIChEVikwggEiMA0GCSqGSIb3DQEBAQUAA4IB
  DwAwggEKAoIBAQDb35hy4n2++IwQugngjoo+vTq7C6vSAb/nxrszE4YsUjIjplgq
  KokM5D9sWettaCMeITxj2ZhW9ADnM5/FC7e1KG/jMsQvl3T7RrL2+ATXAQOJUic8
  3NrYgl6KEfSyUzsDUp5aCHxcMM2ND/I3wKPBB0P5qnDzBMY3BZ0gNS9QoNrIlClV
  0MxDYqoQ5xQ6deoDqfqf3uL3793U3t7kbxl2Ciwa5mog+vVEezz/2GRF1SoWym9k
  Hcyc43S4sotno83G6co2KAHunvxWStbft4D+Z5UMKXu94y6Fd3rsLFkBDGzcbRAF
  bny69OEDT4h6jTig9AiRXNV3qaVdDu3V2qGDAgMBAAGjggE+MIIBOjAfBgNVHSME
  GDAWgBShcl8mGyiYQ5VdBzfVhZadS9LDRTAdBgNVHQ4EFgQUljab+Nbls2hKcHp6
  co3TbiwLuTEwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwGAYD
  VR0gBBEwDzANBgsrBgEEAbIxAQICGDBEBgNVHR8EPTA7MDmgN6A1hjNodHRwOi8v
  Y3JsLnVzZXJ0cnVzdC5jb20vVVROLVVTRVJGaXJzdC1IYXJkd2FyZS5jcmwwdAYI
  KwYBBQUHAQEEaDBmMD0GCCsGAQUFBzAChjFodHRwOi8vY3J0LnVzZXJ0cnVzdC5j
  b20vVVROQWRkVHJ1c3RTZXJ2ZXJfQ0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8v
  b2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQAXWnM9ZOVO0QnA
  f5QatfLiOFtet8kc7l7sG7mXBtDszEEWkxLUs5q2vTq4oRgAVxLS/Yevzbp2mnP5
  4CPTRec4XNP2cI9BEPV0eMlY2WNj+CBIxlRDDH1RE6c37444iOlIlg3PyiB/13dD
  dcHPVCNVsnvYp/McjIvownKpWEBl+qodi0n+cyIuZZzmlJ1PChFSnxKlMu0PpFKk
  C3OyZyQXX8R+n6KAhBHVCaGFy+/BSf9qteHHwtP0JmZA9Rs8ceQn+4OSYSdD+w6g
  cXcBhYbFtFL2WZu/FQURsNFwobVtnHpacWMBqrXoGQUWAnjKBcIsnmSRHydSgzs1
  6puZ4tlM
  -----END CERTIFICATE-----
  

  And save the file as Register_com_CA_SSL_Services.crt and you MUST use the extention ".crt" or the ICA client will not accept the certificates. Now repeat the process for all CA's in the chain and save them all. Then add it to the ICA keystore by moving them to the ICAClient/keystore/cacerts directory (the location of ICAClient is the path you choose during the installation).
• Try again and it should be working

Kudos & references

• Madox.NET Citrix Linux Client 64bit (AMD64) for Ubuntu Jaunty 9.04
• Installing the Citrix Presentation Server Client under Ubuntu 8.10
• [ubuntu] HowTo Install the Citrix ICA client
• Citrix ICA Client How-To for Linux