Product Documentation

Secure user sessions using SSL

Feb 26, 2018

As of Version 7.16, the Linux VDA supports SSL encryption for secure user sessions. SSL encryption is disabled by default.

Enable SSL encryption

To enable SSL encryption for secure user sessions, obtain certificates and enable SSL encryption on both the Linux VDA and the Delivery Controller (the Controller).

Obtain certificates

Obtain server certificates in PEM format and root certificates in CRT format from a trusted Certificate Authority (CA). A server certificate contains the following sections:

  • Certificate
  • Password-decrypted private key
  • Intermediate certificates (optional)

An example of a server certificate:

Example Copy

-----BEGIN CERTIFICATE-----

MIIDTTCCAragAwIBAgIJALluncpiqGXCMA0GCSqGSIb3DQEBBQUAMGcxCzAJBgNV

BAYTAlVLMRIwEAYDVQQIEwlDYW1icmlkZ2UxEjAQBgNVBAcTCUNhbWJvdXJuZTEU

MBIGA1UEChMLQ2l0cml4IFRlc3QxGjAYBgNVBAMTEWNhMDAxLmNpdHJpdGUubmV0

MB4XDTA4MDkzMDEwNTk1M1oXDTI4MDkyNTEwNTk1M1owgYoxCzAJBgNVBAYTAlVL

MRIwEAYDVQQIEwlDYW1icmlkZ2UxEjAQBgNVBAcTCUNhbWJvdXJuZTEUMBIGA1UE

ChMLQ2l0cml4IFRlc3QxGzAZBgNVBAsTElNlcnZlciBDZXJ0aWZpY2F0ZTEgMB4G

A1UEAxMXY2EwMDEtc2MwMDEuY2l0cml0ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQAD

gY0AMIGJAoGBALCTTOdxcivbI0L0F66xgO5gkNeIGKVP+37pSKV8B66lWCVzr6p9

t72Fa+9oCcf2x/ue274NXFcg4fqGRDsrEw13YxM6COyBf7L6psrsCDNnBP1q8TJH

4xoPIXUeaW4MVk/3PVyfhHKs4fz8yy1I4VDnXVHhw+0FQ2Bq3NhwsRhnAgMBAAGj

gdwwgdkwCQYDVR0TBAIwADAdBgNVHQ4EFgQUrLidzYot+CUXSh9xMfp1M+/O8y0w

gZkGA1UdIwSBkTCBjoAU85kN1EPJ0cVhcOss1slseDQwGsKha6RpMGcxCzAJBgNV

BAYTAlVLMRIwEAYDVQQIEwlDYW1icmlkZ2UxEjAQBgNVBAcTCUNhbWJvdXJuZTEU

MBIGA1UEChMLQ2l0cml4IFRlc3QxGjAYBgNVBAMTEWNhMDAxLmNpdHJpdGUubmV0

ggkAy8nC8dcB32EwEQYJYIZIAYb4QgEBBAQDAgVgMA0GCSqGSIb3DQEBBQUAA4GB

AD5axBYHwIxJCJzNt2zdXnbp200yUToWElBwQe/9cGaP6CpjoxJ7FJa2/8IpaT68

VelBu1SEYY1GKCGCw93pc7sPKqb8pGBRI5/dygb+geFk1Q7KyVbu0IjOtr3pkxAe

b6CFJtNLudHUrwF6l0rB72zbyz3PiIx+HEwt1j0j8z4K

-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----

MIICXgIBAAKBgQCwk0zncXIr2yNC9BeusYDuYJDXiBilT/t+6UilfAeupVglc6+q

fbe9hWvvaAnH9sf7ntu+DVxXIOH6hkQ7KxMNd2MTOgjsgX+y+qbK7AgzZwT9avEy

R+MaDyF1HmluDFZP9z1cn4RyrOH8/MstSOFQ511R4cPtBUNgatzYcLEYZwIDAQAB

AoGBAKwBgZu/bkl8edgB8YPyU7diiBX89I0s4b/aPjM+JDmjxb8N96RsPO24p9Ea

FtUc9+iL8mEroLUbSicCXjsJFc+cxg9vVaNa6EEkkBj735oCUERqSx0Yb/lAdck/

FXzU0tqytUe/KHgcSgjtjrSeqLJqMm+yxzBAatVRTTzGdwAhAkEA3l1KRZjIN5uz

Enmi2RTI3ngBhBP/S3GEbvJfKsD5n2Ri90+OoEPxclvvp5ne8Q0zUpshbjFEPb0C

ykZ6UassFwJBAMtI5yPnV9ewPzJoaNjZIJcMtNXDchSlxXiJiyzv+Qmr8RuQz9Pv

fIenmTrfZ+Wo4DaKg+8ar2OvOnKF0HFAmDECQQDEwR1H6cE3WyCfN1u942M9XkhR

GvSpR7+b///vL6Nwwv3CwPV9n8DTpL+wuDkJZ9nCvRteil9MlaMTYjs3alNvAkEA

qy5JzZcbBnrYzMbVO32jju7ZPISnhTGO1xDjzMSLLpTGpNLN34b0k3sTclr8L42E

uQjtTqRm+wdsrVF3lFazkQJANudmsUVv3gZKhMGaV2hzIdXIfHyOIYv+3leZhQY6

h5eEmxSZS50TvyNGt2e6m2ZgaZmjTagH59TCBHvR5nof2g==

-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE-----

MIIDGTCCAoKgAwIBAgIJAMvJwvHXAd9hMA0GCSqGSIb3DQEBBQUAMGcxCzAJBgNV

BAYTAlVLMRIwEAYDVQQIEwlDYW1icmlkZ2UxEjAQBgNVBAcTCUNhbWJvdXJuZTEU

MBIGA1UEChMLQ2l0cml4IFRlc3QxGjAYBgNVBAMTEWNhMDAxLmNpdHJpdGUubmV0

MB4XDTA4MDkzMDEwNDExMVoXDTI4MDkyNTEwNDExMVowZzELMAkGA1UEBhMCVUsx

EjAQBgNVBAgTCUNhbWJyaWRnZTESMBAGA1UEBxMJQ2FtYm91cm5lMRQwEgYDVQQK

EwtDaXRyaXggVGVzdDEaMBgGA1UEAxMRY2EwMDEuY2l0cml0ZS5uZXQwgZ8wDQYJ

KoZIhvcNAQEBBQADgY0AMIGJAoGBAKVZmF7Uj7u0nvO3Qwdfi0nr3QkNH2DXpWrZ

Zh8cI9Vv+UFRUiC6oB7izLtBMFn3fOUP7i2CfkHN3ZGJ17p89pdyjket1MslVeJw

acOqrYvD+fNNSvJjunTbaCywVtALjmFSfMHeZJXVSckrpEhnk0nkMS16tcrya/K/

osSlzvI3AgMBAAGjgcwwgckwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU85kN1EPJ

0cVhcOss1slseDQwGsIwgZkGA1UdIwSBkTCBjoAU85kN1EPJ0cVhcOss1slseDQw

GsKha6RpMGcxCzAJBgNVBAYTAlVLMRIwEAYDVQQIEwlDYW1icmlkZ2UxEjAQBgNV

BAcTCUNhbWJvdXJuZTEUMBIGA1UEChMLQ2l0cml4IFRlc3QxGjAYBgNVBAMTEWNh

MDAxLmNpdHJpdGUubmV0ggkAy8nC8dcB32EwDQYJKoZIhvcNAQEFBQADgYEAIZ4Z

gXLLXf12RNqh/awtSbd41Ugv8BIKAsg5zhNAiTiXbzz8Cl3ec53Fb6nigMWc5Tli

UNCLXwnxRUiD400tESLX9ACUNH3I94yxOgujkSOSBni21jjZTvfBB32Rmr5DByJg

UmKORn/hdqMlcqpe5wO6as6+HN4WUOi+hEtUMME=

-----END CERTIFICATE-----

Enable SSL encryption

  • Enable SSL encryption on the Linux VDA

On the Linux VDA, use the enable_vdassl.sh tool to enable (or disable) SSL encryption. The tool is located in the /opt/Citrix/VDA/sbin directory. For information about options available in the tool, run the /opt/Citrix/VDA/sbin/enable_vdassl.sh –h command. 

Tip: A server certificate must be installed on each Linux VDA server and root certificates must be installed on each Linux VDA server and client.

  • Enable SSL encryption on the Controller

Note

  • The Controller must use the Fully Qualified Domain Name (FQDN) of the Linux VDA. It cannot use the IP address, which is used by default, to connect to the target Linux VDA.
  • You can enable SSL encryption only for entire delivery groups. You cannot enable SSL encryption for specific applications. 

In a PowerShell window on the Controller, run the following commands in sequence to enable SSL encryption for the target delivery group and to make the Controller use the FQDN of the Linux VDA.

  1. Asnp citrix.*
  2. Get-BrokerAccessPolicyRule –DesktopGroupName ‘GROUPNAME’ | Set-BrokerAccessPolicyRule –HdxSslEnabled $true
  3. Set-BrokerSite –DnsResolutionEnabled $true

To disable SSL encryption on the Controller, run the following commands in sequence:

  1. Asnp citrix.*
  2. Get-BrokerAccessPolicyRule –DesktopGroupName ‘GROUPNAME’ | Set-BrokerAccessPolicyRule –HdxSslEnabled $false
  3. Set-BrokerSite –DnsResolutionEnabled $false

Troubleshooting

The following “Can't assign requested address” error might occur in Citrix Receiver for Windows when you try to access a published desktop session:

localized image

As a workaround, add an entry to the hosts file, which is similar to:

10.108.13.180      rhvm72work.citrixlab.local

Where

  • 10.108.13.180 is the IP address of the Linux VDA.
  • rhvm72work.citrixlab.local is the FQDN of the Linux VDA.

On Windows machines, the hosts file typically locates at C:\Windows\System32\drivers\etc\hosts.