Guys, our team recently had to work on a problem where the PNAgent on multiple client workstations (not all client workstations, though) would complain that it would not be able to verify the CRL and therefore would not connect to Services Site.
Error: This computer could not contact the certificate revocation server so can not be used as it may have been revoked
We have dealt with this problem in the past and the solution has always been to add the SSLCertificateRevocationCheckPolicy=NoCheck to the ICA file in the PNAgent site (or on the client via the appsrv.ini or the Windows Registry configuration of Citrix client --. NetworkSSLSSLCertificateRevocationCheckPolicy with a NoCheck value.
My question is, has this changed in the latest versions of clients such as 12.X? We recently ran into this problem where the settings described above did not work for several workstations (XP Pro and 7) running IE8 and IE9 respectively. What did work was to disable the 'check for publisher's certificate revocation' in IE Internet Options --> Advanced --> Security. Obviously, this is not a solution but an insecure 'workaround'.
We checked our domain CA and inspected the certificate and the CRLs were retrieved currently from the client computer (certutil -url command). Not sure what happened that the Citrix client could not see this information but yet the certutil reported the correct CRL result).
Is there a way to remove this dependency of the Citrix client on the domain CA? Some companies may not have a very solid redundant AD CS infrastructure and even so, AD CS is not without problems. I would appreciate any information we can get about this. Yes, this can be disabled on the Windows client using the setting described above (IE 'check for publisher's certificate revocation' unchecked) but most companies would not be willing to accept this as the solution. Is there a way to prevent the Citrix client from performing this check? The SSLCertificateRevocationCheckPolicy NoCheck configuration used to work but it doesn't anymore.
Any information, suggestions, etc welcome.
Thank you.
Citrix Receiver
Check if download.citrixonline.com is a scam website or a legit website. Is download.citrixonline.com fraudulent or infected with malware, phishing, fraud, scam and spam activity. The Best App to Record Video from citrixonline.com Jaksta Media Recorder is the best at recording from citrixonline.com. Jaksta Media Recorder is best described as an all in one Citrixonline.com Downloader, Citrixonline.com Recorder and Citrixonline.com Capture Tool for both Video and Music.