Error: “SSL Error 61: You have not chosen to trust ‘Certificate Authority’…” on Workspace App for Mac

Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.

Update to the Latest Receiver Version

  • Upgrade to the latest version of Receiver to verify if this resolves the issue.
  • If you are using SHA2 certificates then the older version of Receiver does not support these certificate. Refer to CTX200114 – Citrix Receiver Support for SHA-2 to view the Receiver versions which supports SHA-2 certificates.

If this does not resolve the issue then proceed to the next section.

For information on Receiver feature updates refer to – Citrix Receiver Feature Matrix.

Missing Root/Intermediate Certificate

This error message suggests that the Mac client device does not have the required root certificate/intermediate certificate to establish trust with the certificate authority who issued the Secure Gateway/NetScaler Gateway server certificate.

Complete the following steps to resolve this issue:

For Big Sur, please refer to Add certificates to a keychain using Keychain Access on macOS Big Sur

For Catalina, please refer to Add certificates to a keychain using Keychain Access on macOS Catalina


The default File Format should be Certificate (.cer).

Note: You might need to rename the certificate to a .CRT extension for the client to properly identify the certificate.

Save the certificate to the ApplicationsCitrix ICA Clientkeystorecacerts folder (create this folder if it does not exist):

User-added image

Related:

  • No Related Posts

Error “Could not import the certificate” when uploading external SSL certificate to Citrix Endpoint Management console

To repackage the certificate keystore, rebuild the keystore using the old one.

1. Extract Private key from the old keystore to private-key.pem

openssl pkcs12 -in <oldkeystorefile>.pfx -nocerts -out private-key.pem -nodes

2. Extract the certificate to certificate.pem

openssl pkcs12 -in <oldkeystorefile>.pfx -nokeys -out certificate.pem

3. Open certificate.pem in a text editor

Copy 1st Certificate from “—-BEGIN CERTIFICATE—–” to “—–END CERTIFICATE—–” to file called ssl_cert.pem

Copy next 2 or more certificates from “—-BEGIN CERTIFICATE—–” to “—–END CERTIFICATE—–” to file called ssl_intermediateandroot.pem

4. Verify ssl cert.

openssl x509 -text -noout -in ssl_cert.pem

5. Verify certificate chain.

openssl x509 -text -noout -in ssl_intermediateandroot.pem

6. Export combined pfx file

openssl pkcs12 -export -out ssl_cert_with_full_chain.pfx -inkey private-key.pem -in ssl_cert.pem -certfile ssl_intermediateandroot.pem

Note: This step will ask for a password.

Related:

  • No Related Posts

SSL Error 76: “The security certificate was revoked” When Launching an Application Using NetScaler Gateway

SSL error 76 occurs when a certificate is revoked and it is part of a Certificate Revocation List (CRL). If the revoked certificate is still in use, the ICA client displays this error.

However, even after replacing the certificate with a valid one, the error could still occur. This might happen because of cached CRLs in the user’s profile or machine cache that still identify the certificate as revoked.

Related:

  • No Related Posts

WISeKey Joins the Hyperledger Global Community, an Open Source Collaborative Effort Created …

WISeKey Joins the Hyperledger Global Community, an Open Source Collaborative Effort Created to Advance Cross-Industry Blockchain Technologies

ZUG, Switzerland – December 10, 2020 – WISeKey (NASDAQ: WKEY; SIX Swiss Exchange: WIHN, NASDAQ: WKEY), a leading cybersecurity IoT company, today announced that is has joined Hyperledger, the multi-venture, multi-stakeholder effort hosted by the Linux Foundation. Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployment.

Carlos Moreira, WISeKey’s Founder and CEO noted, “We are excited to join the Hyperledger community, and we look forward to working with its members to facilitate the rapid and global adaptation of blockchain-based solutions. WISeKey’s technology supports an ecosystem of connected devices and creates a secured platform to help these devices become intelligent and trusted, able to identify, authenticate and verify each other, gather and analyze data and then safely share with other devices. As a pioneer of blockchain technologies, we are committed to continue our journey of creating cutting-edge applications designed to solve peoples’ problems, transform businesses and create a better world.”

“There are many promising opportunities for leveraging blockchain alongside IoT,” said Brian Behlendorf, Executive Director, Hyperledger. “WISeKey’s understanding of IoT use cases and focus on building secure, decentralized platforms for connected devices will add welcomed expertise to our ecosystem. We look forward to WISeKey’s contributions to the Hyperledger community and the larger efforts to drive convergence of emerging technologies.”

WISeKey’s blockchain-based solutions aim to override the need for a central authority by distributing information previously held in a centralized repository across a network of participating nodes. While blockchain is not owned by one individual or organization, anyone with an internet connection (and access, in the case of private blockchains) can make use of it, help maintain and verify it. When a transaction is made on a blockchain, it is added to a group of transactions, known as “blocks.” Each block of transactions is added to the database in a chronological, immutable chain. Each block is stamped with a unique cryptographic code, which ensures that records are not counterfeited or changed. The blockchain approach lacks legal validity in most jurisdictions, which only recognize the digital signatures as equally valid that manuscript signatures when generated using traditional PKI technology.

A user-controlled digital identity typically starts with a number, unique to an individual, that is associated with a public key for which the user has the private key issued by the OISTE/WISeKey Crypto Graphic RootKey. The WISeID Network is a most deployed standard for digital identity operating since 1998 by a non-profit organization – OISTE.ORG – designed to bring the neutrality, trust, consent, personal control, and ease-of-use of Digital IDs to the Internet.

A Root of Trust (RoT) is a source that can always be trusted within a cryptographic system. A principal example is a Trusted Certification Authority (CA) which generates digital certificates that can be used for legally binding signed electronic transactions. The traditional PKI does not fit well with the heterogeneous blockchain distributed trust model that leverages the existing trust domains and bridges them to create end-to-end trust between them without relying on any common RoT.

Earlier this year, WISeKey established the Trust Protocol Association (the Association) aiming to create a new Trust Protocol for the Internet by combining traditional Cryptographic Trust Models with permissioned blockchain transactions through strong authentication provided by the OISTE WISeKey RoT, a new Global Trust platform and an ecosystem of governmental, technology and business partners, each representing a certification node with the possibility of having multiple certifications nodes per country.

The Association will promote the use of blockchain technologies internationally, facilitate the rapid adaptation and on-boarding of blockchain-based solutions, and foster stronger collaboration between the public, private and academic sectors. The founding members of the Association, which includes reputable organizations such as the State of Geneva, The BRI Blockchain Research Institute, Oracle, WeCan, Aurachain, Bilwee, OISTE, and WISeKey, have created a number of interconnected Blockchain Centers of Excellence around the world.

The combination of RoT with blockchain generates a new Trust Protocol in order to allow the blockchain to scale trusted transactions with embedded security, ensuring that each transaction submitted to the blockchain is digitally signed using keys that are trusted by the RoT and combining a vertical trust process verified by a reputable Third Trusted Party with the inherent decentralized trust provided by the blockchain.

This dual Trust Model solves one of the biggest challenges for the internet, which is to bridge the currently fragmented trust domains including existing, incompatible national RoTs used by many governments. By combining RoT with blockchain, our innovative Trust Protocol enables a wide range of use cases and business models that simply are not possible with using just current blockchain-based solutions.

One concrete application on the use of this new Trust Protocol is WISeID Trusted Distributed Ledger Technology of Identity used to store the identity of objects and peoples and offers connected objects the ability to identify, authenticate and verify each other with a digital certificate. During each interaction, the Blockchain of Identity verifies and validates each digital certificate to secure the interaction such as the recently announced in collaboration with Bilwee, an Argentina-based automatic collection and payment management platform company, which provides Argentinian companies (soon European too) the ability to maintain cash flow and liquidity through the cancellation of debtor invoices. By using WISeKey’s WISeID digital identification and IBM’s blockchain security platform powered by Hyperledger Fabric companies are able to protect their transactions by uploading invoices to the cloud and safely completing payments which can then be canceled between debtors and creditors.

Connected objects secured with WISeKey’s IoT chips produce a huge amount of Big Data that, when analyzed with AI, can help industrial applications to predict the failure of their equipment before it happens. The WISeKey platform allows the IoT device equipped with these chips to send authenticated data to the cloud using a dual factor authentication at the device level. Imagine a smartcard sending authenticated data of each component of the car to predict when these parts will require maintenance and to digitally sign all the logs required to prove that service was provided. This platform, which can be used in different industrial applications allows optimized productivity across industries through predictive maintenance on equipment and machinery, creates truly smart homes with connected appliances and provides critical communication between devices including self-driving cars and smart homes. The possibilities that IoT brings to the table are endless.

Additionally, WISeKey’s technology provides smaller IoT manufacturers that do not have the resources or expertise to perform thorough security analysis of their products with the ability to adopt this platform, reducing the number of unprotected products that are released to consumers.

About WISeKey

WISeKey (NASDAQ: WKEY; SIX Swiss Exchange: WIHN, NASDAQ: WKEY) is a leading global cybersecurity company currently deploying large scale digital identity ecosystems for people and objects using Blockchain, AI and IoT respecting the Human as the Fulcrum of the Internet. WISeKey microprocessors secure the pervasive computing shaping today’s Internet of Everything. WISeKey IoT has an install base of over 1.5 billion microchips in virtually all IoT sectors (connected cars, smart cities, drones, agricultural sensors, anti-counterfeiting, smart lighting, servers, computers, mobile phones, crypto tokens etc.). WISeKey is uniquely positioned to be at the edge of IoT as our semiconductors produce a huge amount of Big Data that, when analyzed with Artificial Intelligence (AI), can help industrial applications to predict the failure of their equipment before it happens.

Our technology is Trusted by the OISTE/WISeKey’s Swiss based cryptographic Root of Trust (“RoT”) provides secure authentication and identification, in both physical and virtual environments, for the Internet of Things, Blockchain and Artificial Intelligence. The WISeKey RoT serves as a common trust anchor to ensure the integrity of online transactions among objects and between objects and people. For more information, visit www.wisekey.com.


Press and investor contacts:

WISeKey International Holding Ltd

Company Contact: Carlos Moreira

Chairman & CEO

Tel: +41 22 594 3000

info@wisekey.com
WISeKey Investor Relations (US)

Contact: Lena Cati

The Equity Group Inc.

Tel: +1 212 836-9611

lcati@equityny.com

Disclaimer:

This communication expressly or implicitly contains certain forward-looking statements concerning WISeKey International Holding Ltd and its business. Such statements involve certain known and unknown risks, uncertainties and other factors, which could cause the actual results, financial condition, performance or achievements of WISeKey International Holding Ltd to be materially different from any future results, performance or achievements expressed or implied by such forward-looking statements. WISeKey International Holding Ltd is providing this communication as of this date and does not undertake to update any forward-looking statements contained herein as a result of new information, future events or otherwise.

This press release does not constitute an offer to sell, or a solicitation of an offer to buy, any securities, and it does not constitute an offering prospectus within the meaning of the Swiss Financial Services Act (“FinSA”), the FinSA’s predecessor legislation or advertising within the meaning of the FinSA, or within the meaning of any other securities regulation. Investors must rely on their own evaluation of WISeKey and its securities, including the merits and risks involved. Nothing contained herein is, or shall be relied on as, a promise or representation as to the future performance of WISeKey.

The securities offered will not be, and have not been, registered under the United States of America Securities Act of 1933, as amended, and may not be offered or sold in the United States of America, absent registration or an applicable exemption from the registration requirements of said Act.


Related:

  • No Related Posts

Error: “Cannot Complete Your Request” Due to Misconfigured or Expired Certificates on StoreFront

Complete the following steps on all the StoreFront servers to troubleshoot this issue:

  1. Open the IIS console > Servername > Server Certificates

1) Make sure the Certificate Issued To name matches the StoreFront Base URL.

2) Make sure the Expiration Date is not expired.

3) View the Certificate Details tab of the certificate, verify it contains a private key. If using a SAN certificate, make sure the StoreFront Base URL is listed under the subject alternative names. Wildcard certificates are also supported.

4) View the Certification Path tab of the certificate, confirm that all the Intermediate and Root certificates are properly installed to complete an SSL Handshake.

For more information regarding Server certificates, refer to Microsoft article

Server Certificate Deployment

Configure intermediate certificates on a computer that is running IIS for server authentication

  1. Open the IIS console > Servername > Sites > Default Web Site > Bindings.
1) Make sure there is a binding for HTTPS over port 443.

2) The SSL certificate matches the StoreFront Base URL.

3) The host name field is empty.

For more information regarding adding a binding, refer to Microsoft article – SSL Bindings

Related:

  • No Related Posts

Error: “SSL Error 61: You have not chosen to trust 'Certificate Authority'…” on Receiver for Mac

Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.

Update to the Latest Receiver Version

  • Upgrade to the latest version of Receiver to verify if this resolves the issue.
  • If you are using SHA2 certificates then the older version of Receiver does not support these certificate. Refer to CTX200114 – Citrix Receiver Support for SHA-2 to view the Receiver versions which supports SHA-2 certificates.

If this does not resolve the issue then proceed to the next section.

For information on Receiver feature updates refer to – Citrix Receiver Feature Matrix.

Missing Root/Intermediate Certificate

This error message suggests that the Mac client device does not have the required root certificate/intermediate certificate to establish trust with the certificate authority who issued the Secure Gateway/NetScaler Gateway server certificate.

Complete the following steps to resolve this issue:

  1. Open the Keychain Access in the Applications > Utilities folder:

    User-added image

  2. Highlight the X509 Anchors Keychain in the menu (you might have to authenticate to do this).

  3. Browse through the Certificate Authorities to find the company that has issued the certificate that is being used by the Secure Gateway/NetScaler Gateway – for this example, Thawte Premium Server CA:

    User-added image

  4. Highlight the certificate and select File > Export from the menu bar:

    User-added image

  5. The default File Format should be Certificate (.cer).

    Note: You might need to rename the certificate to a .CRT extension for the client to properly identify the certificate.

  6. Save the certificate to the ApplicationsCitrix ICA Clientkeystorecacerts folder (create this folder if it does not exist):

    User-added image

User-added image

Related:

  • No Related Posts

Error: “SSL Error 61: You have not chosen to trust 'Certificate Authority'…” on Receiver for Windows

Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.

Update to the Latest Receiver Version

  • Upgrade to the latest version of Receiver to verify if this resolves the issue.
  • If you are using SHA2 certificates then the older version of Receiver does not support these certificate. Refer to CTX200114 – Citrix Receiver Support for SHA-2 to view the Receiver versions which supports SHA-2 certificates.

If this does not resolve the issue then proceed to the next section.

For information on Receiver feature updates refer to – Citrix Receiver Feature Matrix.

Missing Root/Intermediate Certificate

This error message suggests that the client device does not have the required root certificate/intermediate certificate to establish trust with the certificate authority who issued the NetScaler Gateway server certificate.

Complete the following steps to resolve this issue:

  1. Download or obtain the SSL root certificate/intermediate certificate (.crt/.cer) file issued by your SSL certificate provider.

    Root certificate/intermediate certificate can be downloaded from your SSL certificate provider’s website or can be obtained on request. Usually root certificate is present in the certificate bundle provided by your SSL service provider along with intermediate and server certificates.

  2. Install the root certificate/intermediate certificate on the client machine.

  3. If an antivirus is installed on the client machine then ensure that the antivirus trusts the certificate.

This process pairs your client machines with the server machine, and is necessary if you do not use a certificate verified by a commercial SSL certificate provider. Most commercial certificate providers arrange to have their certificates pre-installed on machines through an agreement with the operating system creator (Microsoft, Apple, and so on).

User-added image

Server Certificate is Not RFC 3280 Compliant

SSL Error 61 can occur when the server certificate is not compliant with the instructions in RFC 3280 regarding the Enhanced Key Usage field.

The system administrator might need to contact the certificate authority who sold the faulty certificate and inform them that the certificate is in violation of RFC 3280. Also ask the certificate authority to issue a new certificate that contains the following key usage value in addition to any other required values:

Server Authentication (1.3.6.1.5.5.7.3.1)

NetScaler Gateway acts as an SSL server, so Server Authentication (1.3.6.1.5.5.7.3.1) must be listed among the designated key uses if any are present. If the Extended Key Usage field is not present in the certificate, the certificate might be considered valid.

Some certificate authorities erroneously issue certificates that contain only the following key usage extensions that indicate support for Server-Gated Cryptography (SGC):

  • Unknown Key Usage (2.16.840.1.113730.4.1)

  • Unknown Key Usage (1.3.6.1.4.1.311.10.3.3)

These extensions are intended as a signal to Netscape and Internet Explorer web browsers that they should negotiate 128-bit encryption regardless of the normal capabilities of the client. They have no effect on the ICA client. When these two values are the only items listed in the Enhanced Key Usage field, the certificate is in violation of RFC 3280 and should be rejected by SSL clients seeking server authentication.

User-added image

Note: Not all SGC compliant certificates are missing the Server Authentication value and not all invalid certificates are SGC compliant.

After you receive an updated certificate with the correct usage fields listed, replace the certificate on your NetScaler Gateway server using the MMC Certificates snap-in.

Related:

  • No Related Posts

How to Convert a PKCS #7 Certificate to PEM Format for Use with NetScaler

This article describes how to convert a certificate that is received from the Certificate Authority (CA) in PKCS #7 format to PEM format.

Background

This is an alternative method of converting a PKCS #7 Certificates to PEM format, rather than using Open SSL, which sometimes might not work correctly. You receive a certificate from the CA in PKCS #7 [Crypto Graphic message syntax standard] format. The file extension for the certificate is .p7b.

Related:

  • No Related Posts

Error: “SSL Error 61: You have not chosen to trust 'Certificate Authority'…” on Receiver for Linux

Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.

Update to the Latest Receiver Version

  • Upgrade to the latest version of Receiver to verify if this resolves the issue.
  • If you are using SHA2 certificates then the older version of Receiver does not support these certificate. Refer to CTX200114 – Citrix Receiver Support for SHA-2 to view the Receiver versions which supports SHA-2 certificates.

If this does not resolve the issue then proceed to the next section.

For information on Receiver feature updates refer to – Citrix Receiver Feature Matrix.

Missing Root/Intermediate Certificate

This error message suggests that the client device does not have the required root certificate/intermediate certificate to establish trust with the certificate authority who issued the server certificate.

Use a root certificate

If you need to authenticate a server certificate that was issued by a certificate authority and is not yet trusted by the user device, follow these instructions before adding a StoreFront store.

  1. Obtain the root certificate in PEM format.

    Tip: If you cannot find a certificate in this format, use the openssl utility to convert a certificate in CRT format to a .pem file.
  2. As the user who installed the package (usually root):
    1. Copy the file to $ICAROOT/keystore/cacerts.
    2. Run the following command:
      $ICAROOT/util/ctx_rehash

Use an intermediate certificate

If your StoreFront server is not able to provide the intermediate certificates that match the certificate it is using, or you need to install intermediate certificates to support smart card users, follow these steps before adding a StoreFront store.

  1. Obtain the intermediate certificate(s) separately in PEM format.

    Tip: If you cannot find a certificate in this format, use the openssl utility to convert a certificate in CRT format to a .pem file.
  2. As the user who installed the package (usually root):
    1. Copy the file(s) to $ICAROOT/keystore/intcerts.
    2. Run the following command as the user who installed the package:
      $ICAROOT/util/ctx_rehash

Related:

  • No Related Posts