Install a certificate for Citrix Access Gateway

To install a certificate under Citrix Access Gateway:

1. Click on the Access Gateway Cluster tab and open the window for the appliance
2. In the Administration tab, click on Upload a .crt signed certificate then browse
3. Browse to the .cer file downlaoded from your status page.

If your certificate holds a certification chain (if so, it be documented as a certification chain file in the delivery e-mail) you'll have to:

1. Click on the Access Gateway Cluster tab and open the window for the appliance
2. In the Administration tab, click on Manage trusted root certificates then click on Manage
3. In the Manage tab, click on Upload Trusted Root Certificate
4. Browse to the .txt file downloaded from your certificate status page (certification chain)

We do advise to use Thawte Standard products on this kind of platform.

When you will reimport the certificate you might have an error indicating the CAG can not find a matching private key. It that case, generate your CSR from an other server then import it.

For example, you can get a certificate under IIS then export it in PFX then turn it into a PEM file. See http://www.jaytomlin.com/blog/2006/07/certificate_conversion_tools.html

You can do the same by following Apache instructions (with Openssl) then concatenate the private key, the certificate and the certification chain in one file that will be imported in the CAG, see http://support.citrix.com/article/CTX116758.

Attention: Make sure you concatenate a PEM file with a Unix/Linux compatible text editor (ending each line with a Linefeed). For example use Notepad++ rather than Notepad or Wordpad on Windows.

Attention: We have noticed that on more recent version of Access Gateway 5.X (tested on 5.0.4), we needed to import a PFX file.

Useful links:

• Known errors

• Citrix online support
• Citrix support: disable SSLv3
• Citrix support: Install an intermediate certificate