Citrix SHA2 Certificate error on Mac Receiver - You have not chosen to trust "RapidSSL SHA256 CA-G3" Error

Posted on 2015-01-01
Last Modified: 2015-01-07
After a recent renewal of our Citrix FQDN Certificate all users connecting via Mac are receiving the following error when launching an application.

You have not chosen to trust "RapidSSL SHA256 CA-G3" Error the issuer of the servers security certificate.

We have over a 100 in the field so updating the clients individually is a last resort.

We have tested the latest receiver with no luck.

Any advice would be greatly appreciated.
Question by:michael334
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 21

Expert Comment

ID: 40527809

I would suggest to check the certificate and see it is valid (just give the external access of you citrix access). I am sure that this will give some clue where the issue actually lying.
LVL 63

Accepted Solution

btan earned 500 total points
ID: 40527878
First sha2 is supported with Release 10.5 Build 53.9 or higher, but only with TLS v1.2.

Next this is quite similar to the error 61 (which i believe it is) the root certificate of the CA that issued the SSL certificate is not in the client browser's Trusted Root Certification Authority store. In your case it is RapidSSL CA and need to also install those onto the Citrix Server.

Also the client also need to trust any Intermediate certificate for RapidSSL (even if they now trust the root). Hence it may cause the webserver (front end server) not providing details of the Intermediate certificate for the client to establish this cert chain check. So we need to ensure the RapidSSL Intermediate CA certificates are installed

in fact, instead of going to each client, righfully, the Citrix/Web Interface/whatever server front end that your client connects through should install the Intermediates cert on the server. So that no matter what the client is, the server will provide the missing component in the certificate chain (i.e the Intermediate certificate) and thereafter the client will trust it.

... if really did not work out as expected, instead to go into every client machines, probably go into gpo push down to client is more preferred and optimal for domain joined machine

Author Comment

ID: 40536445
The only way we have been able to resolve the issue is to provide the root certificate for Rapid SSL for the individual MAC users as it is not provided in the keychain and there appears to be no way to automate the download from the citrix client or Web Interface,
Even with Yosemite the root certificates for Go Daddy and Rapid SSL are not included and have to be added manually.

I hate technology....

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After several days of searching and hunting for limited documentation, I wanted to share this guide to hopefully save someone the hassle of trying to figure this out on their own. I have tested this on Xendesktop 7.1 and PS 4.5 running simultaneous…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question