Product documentation
Linux Virtual Delivery Agent
Current Release 2203 LTSR 2201 2112 2110 2109 2107 2106 2104 2103 2012 1912 LTSR 7.15 LTSR
View PDF

Secure user sessions using TLS

May 25, 2022
Contributed by: 
B

Starting with Version 7.16, the Linux VDA supports TLS encryption for secure user sessions. TLS encryption is disabled by default.

Enable TLS encryption

To enable TLS encryption for secure user sessions, install certificates and enable TLS encryption on both the Linux VDA and the Delivery Controller (the Controller).

Install certificates on the Linux VDA

Obtain server certificates in PEM format and root certificates in CRT format. A server certificate contains the following sections:

  • Certificate
  • Unencrypted private key
  • Intermediate certificates (optional)

An example of a server certificate:

An example of a server certificate

Enable TLS encryption

Enable TLS encryption on the Linux VDA

On the Linux VDA, use the enable_vdassl.sh script in the /opt/Citrix/VDA/sbin directory to enable (or disable) TLS encryption. For information about the options available in the script, run the /opt/Citrix/VDA/sbin/enable_vdassl.sh -help command.

The script for enabling SSL

Tip: A server certificate must be installed on each Linux VDA server and root certificates must be installed on each Linux VDA server and client.

Enable TLS encryption on the Controller

Note:

You can enable TLS encryption only for entire delivery groups. You cannot enable TLS encryption for specific applications.

In a PowerShell window on the Controller, run the following commands in sequence to enable TLS encryption for the target delivery group.

  1. Add-PSSnapin citrix.*
  2. Get-BrokerAccessPolicyRule –DesktopGroupName 'GROUPNAME' | Set-BrokerAccessPolicyRule –HdxSslEnabled $true

Note:

To ensure that only VDA FQDNs are contained in an ICA session file, you can also run the Set-BrokerSite –DnsResolutionEnabled $true command. The command enables DNS resolution. If you disable DNS resolution, an ICA session file discloses VDA IP addresses and provides FQDNs only for the TLS-related items such as SSLProxyHost and UDPDTLSPort.

To disable TLS encryption on the Controller, run the following commands in sequence:

  1. Add-PSSnapin citrix.*
  2. Get-BrokerAccessPolicyRule –DesktopGroupName 'GROUPNAME' | Set-BrokerAccessPolicyRule –HdxSslEnabled $false
  3. Set-BrokerSite –DnsResolutionEnabled $false

Troubleshooting

The following “Can’t assign requested address” error might occur in Citrix Workspace app for Windows when you try to access a published desktop session:

Can't assign requested address

As a workaround, add an entry to the hosts file, which is similar to:

<IP address of the Linux VDA>      <FQDN of the Linux VDA>

On Windows machines, the hosts file typically locates at C:\Windows\System32\drivers\etc\hosts.

Secure user sessions using TLS
May 25, 2022
Contributed by: 
B
May 25, 2022
Contributed by: 
B

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings
© 1999- Citrix Systems, Inc. All rights reserved.