Product Documentation

Known issues

Oct 11, 2017

For technical support articles and other support resources for XenMobile, such as software updates and security bulletins, see the Citrix Support Knowledge Center.

Important

Before upgrading to Android O (version 8), users must upgrade Secure Hub and all XenMobile Apps to version 10.6.20. Otherwise, users might not be able to sign on to Secure Hub or open XenMobile Apps. For more information about XenMobile Apps and Android 8, see the information later in this article, the XenMobile Apps Known issues, and XenMobile supported device operating systems

Before upgrading to iOS 11, users must upgrade Secure Hub to to version 10.6.10 or later before upgrading their devices to iOS 11. That upgrade sequence is required because Secure Hub no longer supports SHA-1 certificates on devices running iOS 11. For more information about anticipating this change, see the Knowledge Center article on XenMobile iOS 11 and Android O Support.

Known issues in version 10.7.5

In Secure Mail on iOS 11 devices, silent notifications do not work. As a result, notifications may not appear on the lock screen. When mail synchronizes in the background, however, the notifications do appear. This is a third-party issue. For details and updates, see this Citrix Support Knowledge Center article

Known issues in version 10.7

Secure Hub 10.7

Devices running iOS 11 can't enroll in XenMobile or might have Secure Hub store access issues in the following conditions: If TLS 1.2 isn't enabled on NetScaler and XenMobile is configured with any of the following authentication options:

  • LDAP and certificate authentication

  • Certificate authentication

  • Certificate authentication plus security token

This issue affects:

  • New enrollments through Secure Hub on iOS 11.

  • Existing enrollments, after the device upgrades to iOS 11 and either of these actions occur:

    • The user accesses the Secure Hub store.

    • A XenMobile App or MDX-wrapped app needs to renew a NetScaler Gateway cookie.

This issue occurs because iOS 11 now requires that NetScaler is configured for TLS 1.2 for certificate-based authentication. If you run one of the authentication modes listed above, resolve this issue by enabling TLS 1.2 on NetScaler Gateway. [CXM-33327]

For MDM-enrolled iOS 11 devices, when you deploy XenMobile in a cluster setup in MDM or MDM+MAM mode, MDM commands may fail. As a result, you may not be able to push MDM policies, deploy apps, or carry out security actions, such as lock or wipe, on iOS 11 devices. On user devices, the following issues may occur: Apps keep trying to install; VPN or WiFi configurations fail to install; and security actions, such as Lock happen repeatedly. For more details and required action, see this Citrix Knowledge Center article. [CXM-38331]

On iOS 10 and 11, selecting open in from MDX managed apps displays an error message. [CXM-38912]

Known issues in version 10.6.20

Issues with Android O (version 8)

Before upgrading to Android O, users must upgrade Secure Hub and all XenMobile Apps to version 10.6.20. Otherwise, users might not be able to sign on to Secure Hub or open XenMobile Apps. [CXM-36910]

If you run XenMobile Apps version 10.6.5, 10.6.10, or 10.6.15, and you upgrade to Android O, be aware of the following known issues.

  • Users with Android O devices might not be prompted to change their passcodes to comply with new or updated policies that require stronger passcodes. To ensure users are prompted to change their passcodes, when creating or updating a passcode policy, specify that numbers, letters, or both are required characters. [CXM-28102] [Found in 10.6.5]
  • If users are running a version of Secure Mail earlier than version 10.6.20 and they upgrade to Android O, the following error may appear: The device does not support encryption features required by application. Then, when you update the app in XenMobile, the account is deleted. [CXM-36763] [Found in 10.6.5]
  • In Secure Mail on Android O, the AutoFill option is enabled. [CXM-35112] [Found in 10.6.5 and 10.6.10]
  • On Android O, users are unable to upload files through Secure Web. [CXM-35407] [Found in 10.6.5 and 10.6.10]
  • On Android O, shortcuts created by policies do not appear on the device home screen. This is by design in Android O. [CXM-35460] [Found in 10.6.5 and 10.6.10]
  • If users are running a version of Secure Mail earlier than version 10.6.20 and they upgrade to Android O, the following error may appear: The device does not support encryption features required by application. Then, when you update the app in XenMobile, the account is deleted. [CXM-36763] [Found in 10.6.5 and 10.6.10]
  • Touchdown for Smartphones might stop unexpectedly on devices running Android O. [CXM-36685] [Found in 10.6.5, 10.6.10, and 10.6.15]
  • In Secure Hub for Android, when you deploy a Wi-Fi policy with hidden network settings enabled, the settings don’t appear on the device as expected. This is a third-party issue. [CXM-37585][Found in 10.6.20]

Note: On Secure Mail for Android with IBM Lotus Notes version 9.0.1, invitees might not receive reminders for non-recurring meetings. [CXM-37691]

Known issues in version 10.6.15

Secure Web 10.6.15

On Secure Web for Android, after saving a page for offline viewing, the page does not render. [CXM-36270]

Secure Mail 10.6.15

On Secure Mail for iOS with multiple accounts, tapping the email triage action Move to from a secondary account displays the folders of the primary account. This issue affects iPhone devices. [CXM-35911]

The XenMobile Apps 10.6.10 and 10.6.5 releases include no known issues. For fixed issues, see Fixed issues

Known issues in version 10.5.20

Secure Hub 10.5.20

On Android, if a device is enrolled in XenMobile Essentials and gets wiped, they can reenroll without supplying their Azure Active Directory credentials again. [CXM-29653]

On Android devices, after a selective wipe, Secure Hub should revert to the first time user screen. Instead, the app hangs. [CXM-29660]

After upgrading, Secure Hub might fail to prompt users to sign in using fingerprint authentication when expected. Instead, users might be prompted twice to authenticate using a Citrix PIN or passcode before being prompted to authenticate using fingerprint authentication. [CXM-31213]

On Android, users cannot see the upgrade progress bar when updating enterprise apps through Secure Hub without signing off then signing back on. [CXM-32119]

Secure Mail 10.5.20

On Android, when a user scrolls to a native calendar event beyond one month in Secure Mail, switching to Week or Day view and then back to Month view, the event does not display. This happens intermittently. [CXM-30870]

On Android, if users enable personal calendar overlay in Secure Mail then scroll back through calendar events in agenda view, tapping the Today button does not display today's events. This happens intermittently. [CXM-30875]

On Android, when a user enables personal calendar overlay and scrolls back over three months in agenda view, a message displays "Touch to view events after..." and the date. Touching this message does not load more events. This happens intermittently. [CXM-30877]

On Android, when a user enables personal calendar overlay and opens an event from Month view, upon closing the event, random events are highlighted. This happens consistently on devices running Android 4.x and intermittently on other devices. [CXM-30879]

In Secure Mail for iOS, when users press Edit on the Mail screen to edit mail and then long press, when they exit the edit mode, the folder list menu does not appear as expected. To resolve the issue, users must close and reopen Secure Mail. [CXM-32147] 

Known issues in version 10.5.15

Secure Hub 10.5.15

After users enroll and reenroll an iOS device, when you create and deploy, for the first time, a delivery group with required apps, this issue occurs: MDX, public app store, and enterprise apps in the delivery group are not pushed to the device. Only web SaaS and web links deploy. All apps deploy only if users refresh the app store or if they sign off and on again. [CXM-30386]

Secure Mail 10.5.15

With NetScaler 12.0.41.16, when Secure Mail is configured with STA, mail sync fails on iOS and Android devices. The issue is fixed in NetScaler 12.0 build 41.22. For details and updates, see this Support Knowledge Center article.  [#685075]

On a Nexus 6P device running Android 7.x, if S/MIME is enabled, Secure Mail crashes while trying to encrypt and sign an email with a large attachment. [CXM-29544]

Known issues in version 10.5.10

Secure Hub 10.5.10

Attempts to enroll devices running Android 4.4.x in an IDP-enabled XenMobile Server in Secure Hub for Android might fail, showing a blank enrollment page. As a workaround, do one of the following:

  • Force Secure Hub to close on the device.
  • Restart the device after the second enrollment attempt. [CXM-24145]

Secure Web 10.5.10

When you set the Enable_Secret_Using_Passcode flag to true in the XenMobile console to enable user entropy, the following issue occurs on Android devices. When users are enrolled in Secure Hub and have already opened Secure Web, when they restart the device and then reopen the app, Secure Web closes. To resolve the issue, users can open Secure Hub and then open Secure Web. [CXM-26413]

Secure Mail 10.5.10

In Secure Mail for iOS, a Download Complete Message does not appear when the body of the message is larger than the truncation size set in Exchange Server 2013 CU 15. [CXM-25885]

Values set in Exchange Server 2013 CU 15 for including past email items are not reflected in Secure Mail for Android or iOS. [CXM-26017, CXM-26023]

Known issues in version 10.5.5

Secure Hub 10.5.5

On Android, when Secure Hub attempts to re-authenticate the session of a user, the first authentication screen is slow or unusable. [CXM-24293]

In Secure Hub for Android, when the inactivity timer expires and users enter a wrong PIN, when they tap Having trouble and try to re-enroll, a Deleting account message appears. At that time, the account is not deleted and a PIN screen appears. If users enters the wrong PIN again and try to re-enroll by tapping Having Trouble, the account is deleted. [CXM-24717]

Secure Mail 10.5.5

When users open Secure Mail for Android and are prompted for authentication, if they do not provide their credentials and instead switch to Secure Hub for authentication, when they open the app from the home screen, the My Apps screen appears instead of Secure Mail. As a workaround, users can restart Secure Mail. [CXM-24072]

Known issues in version 10.5

In a XenMobile enterprise deployment (MDM + MAM), when you configure automatic app updates for enrolled iOS devices, the following issue occurs intermittently. After users update XenMobile Apps from public app stores, an earlier version of the apps installs. As a result, users are prompted to upgrade, and the pattern repeats. The issue does not occur with Secure Hub. As a workaround, users can update the app directly from the app store. For details, see https://support.citrix.com/article/CTX220607.

Secure Hub 10.5

  • On Android devices, changing the required length of the Secure Hub PIN in XenMobile Server causes the old PIN to be refused. This requires a PIN reset. [CXM-23637]
  • On Android devices, when resetting your PIN in an MDX app due to exceeding invalid attempts, old PINs will be accepted as replacements without honoring the value configured in PIN history [CXM-23638]

For known issues with Secure Hub that relate to XenMobile Server, see Known issues.

Secure Mail 10.5

  • On Samsung 7 devices running Android 7, when a user deletes VIP contacts in Secure Mail, the app crashes intermittently. [CXM-23516]
  • On Android devices, long pressing a link in Secure Mail and attempting to share it with ShareFile does not work. [CXM-23594]

Secure Hub 10.4.10

  • On iOS devices, if a user enables the Credential Store flag in XenMobile, enters their XenMobile Server FQDN or URL in Secure Hub, enrolls using their user name and password, and then opens Secure Mail, the app is not configured automatically. [CXM-23414]

Secure Web 10.4.10

  • On Android 7 devices, after the inactivity timer expires, when a user opens Secure Web, enters an invalid PIN, and resets the PIN, websites fail to load. If users then close and re-open Secure Web, the websites load properly. [CXM-23274]

Secure Mail for Android 10.4.6 for enterprise distribution

  • On Android devices, when you block location services in XenMobile, Secure Mail users are notified intermittently that the location service is blocked. [CXM-21770]
  • If Secure Mail version 10.4.5 or 10.4.10 is installed for the first time (not upgraded) on devices running Android 6.0.1 or later, users cannot email a file with Secure Mail when using the ShareFile or QuickEdit apps, unless they grant the Storage Access Permission for Secure Mail in Android device settings. [CXM-23277]
  • On Samsung S7 devices running Android 7, the paste option will not display on long press when composing a mail. [CXM-23494]
  • On Samsung 7 devices running Android 7, when a user deletes VIP contacts in Secure Mail, the app crashes intermittently. [CXM-23516]

For known issues with the MDX Toolkit, see Known issues.

Known issues in version 10.4.5

The following are known issues in version 10.4.5 of XenMobile Apps.

Secure Hub

The XenMobile location policy setting that locks devices locally when the geofencing perimeter is breached fails to take effect on devices running Android 7.0 or later, due to a limitation Android has placed on the resetPassword API. [CXM-20320][CXM-14990]

When you convert XenMobile Apps to managed on an iOS device, when you delete a user account, the apps are not removed from the device home screen. Instead, an "App Not Available" message appears. [CXM-19133]

On iOS, when XenMobile Apps are converted from unmanaged to managed mode and the inactivity timer expires, once WiFi is restored, Secure Hub prompts users for their passcodes multiple times. [CXM-18694]

With Citrix Launcher, in MDM mode, when users open the XenMobile Store, the store opens in a default browser even if you listed a different browser on a white list. [CXM-17097]

When you configure Citrix Launcher, the Just Once option does not work. You must click the Always option. [CXM-13413]

When you integrate StoreFront with XenMobile and deploy HDX apps, after you change an Active Directory password, the HDX apps disappear from the Worx Store/XenMobile Store. [CXM-9859]

Secure Mail

On iOS in FIPS mode with S/MIME enabled, Secure Mail crashes when a user enters a password to import an attached S/MIME certificate. [CXM-19526]

In Secure Mail for iOS, when you set an all-day event: After recipients accept the meeting invitation, the meeting appears on a different day in Agenda view. The issue occurs only when the organizer and attendees are in different time zones. The meeting day appears correctly in all other views. [CXM-21017]

Secure Web

On the public app store version of Secure Web for Android, Web Links do not open and a toast message appears to the user. [CXM-20425]

Known issues in version 10.4.1

Secure Hub

With Citrix Launcher, in MDM mode, when users open the XenMobile Store, the store opens in a default browser even if you listed a different browser on a whitelist. [CXM-17097]

When you configure Citrix Launcher, the Just Once option does not work. You must click the Always option. [CXM-13413]

When users install any public app store version of any XenMobile app on Android devices in unmanaged mode and open the app and then install Secure Hub and enroll in XenMobile, when they open the XenMobile app again and the device is offline, the app does not change to managed mode. Instead, a network connection error appears. [CXM-18068]

On iOS, when XenMobile Apps are converted from unmanaged to managed mode and the inactivity timer expires, once WiFI is restored Secure Hub prompts users for their passcodes multiple times. [CXM-18694]

When you convert XenMobile Apps to managed on an iOS device, when you delete user account, the apps are not removed from the device home screen. Instead, an "App Not Available" message appears. [CXM-19133]

Due to a third-party issue with the iOS operating system, devices set to a language other than English may nonetheless show alerts for Secure Hub in English. For more information about the issue, see https://forums.developer.apple.com/thread/45821.

Secure Mail

If a device is running a version of Secure Mail downloaded from the App Store and ShareFile is not installed on the device, the user sees an alert to go to the App Store and download ShareFile. However, when the user taps the Go to App Store button, the app flips to the main App Store page instead of flipping to the ShareFile App Store page, forcing the user to search for ShareFile. [CXM-17389]

On iOS, when trying to attach documents from ShareFile, and ShareFile version 4.2 or below is installed on a device, the user sees a message asking to upgrade to ShareFile from the App Store. However, when the user taps Go to App Store, the XenMobile Store opens instead. [CXM-20170]

In some cases, Secure Mail is unable to display files attached to emails that are sent as attachments. [CXM-17127]

On iOS, when Secure Mail is restored from the background and a user opens a draft message and then tries to save it, the draft message is deleted. [CXM-17048]

On iOS, Secure Mail crashes after a period of inactivity. [CXM-14959]

On iOS, if the size of a message is less than the message truncation size set on Exchange, users still see a Download Complete Message request. If users forward the message without tapping Download Complete Message, the forwarded messages also is truncated. [CXM-17590]

Secure Forms

When users submit forms from the mobile app, the form shows in the Submitted tab as not submitted and users see an error message, such as "Unable to Sync," even though the form and related data are in fact collected by the configured method. [CXM-20112]

Known issues in version 10.4

Secure Web

In Secure Web for Windows, when users try to view and download a file using a ShareFile link, the preview does not appear and the file does not download properly. [CXM-13435]

In Secure Web on Android 4.4.4 devices, if a session timeout occurs on NetScaler Gateway, users are prompted to sign on in Secure Hub. After users authenticate successfully, Secure Hub does not flip to Secure Web as expected. [CXM-18084]

Secure Mail

In Secure Mail for Windows, when you set the Inactivity Timer MDX policy to 150 minutes and the Maximum offline policy to 1 hour, when users open Secure Mail and let the app go to the background, if the Maximum offline interval ends, users are not prompted to sign on again to Secure Mail as expected. [CXM-14634]

In Secure Mail for Windows, when the Online session required MDX policy is set to OFF and the App passcode policy is set to ON, when users open Secure Mail, if the user session on NetScaler Gateway ends, they are not prompted to authenticate to Secure Hub, as expected. [CXM-14728, CXM-14716]

When you enable client certificate only authentication (for example, without a domain), when users install and open Secure Mail for Windows, an authentication dialog box appears in error. [CXM-15191]

In Secure Mail on some Android devices, when users compose a mail and start typing in the To, CC, or BCC fields, a delay occurs in the appearance of the characters. [CXM-18509]

Secure Hub

In a configuration with NetScaler, users cannot reenroll an iOS device in Secure Hub. [CXM-15405]

Enrollment fails on iOS devices through Secure Hub when the NetScaler session profile Account Services address does not contain the XenMobile Server URL. [CXM-15408]

After you delete a device in the XenMobile console, on Android devices, users are prompted to sign on from Secure Hub instead of being prompted to reenroll. After signing on, however, users cannot access their apps. [CXM-17833]

In a XenMobile MAM-only deployment, when XenMobile Apps are updated to version 10.4, but Secure Hub is version 10.3, an app compatibility error appears on Android devices. [CXM-17993]

In Secure Home for iOS 10, users are not prompted to sign on again when Secure Hub remains in the foreground and the inactivity timer expires. [CXM-18245]