Release notes for the macOS clients

Last published : Oct 14, 2026
The release notes describe the new features, enhancements to existing features, fixed issues, and known issues available in a service release. The release notes include one or more of the following sections:
What's new: The new features and enhancements available in the current release.
Fixed issues: The issues that are fixed in the current release.
Known issues: The issues that exist in the current release and their workarounds, wherever applicable.
Important information:
  • EPA clients are supported on macOS 10.13, 10.14, 10.15, 11.x, 12.x, 13.x, 14.x, and 15.x versions.
  • EPA clients are supported on the NetScaler 12.1, 13.0, 13.1, and 14.1 versions.
  • Citrix Secure Access for macOS/iOS 24.06.1 and later releases address the TunnelVision vulnerabilities described in CVE-2024-3661.
Related information
Citrix Secure Access for macOS/iOS

V25.11.3 (Oct 05, 2026)

Important:
This build is only available in the App Store.

What's new

This release addresses issues to improve the overall performance, security, and stability.

V26.09.1.1 (Sep 24, 2026)

What's new

  • This release introduces day-zero support for macOS 27, and includes performance and stability fixes.
  • EPA libraries are updated to 26.8.1.0 (OPSWAT OESIS library version 4.3.5914.0).

V26.08.1.1 (Aug 24, 2026)

Important:
This build is only available in the Citrix Downloads page.

What's new

  • This release addresses some issues to improve the overall performance and stability.
  • EPA libraries are updated to 26.7.1.0 (OPSWAT OESIS library version 4.3.5733.0).

V26.06.1.1 (Jul 14, 2026)

Important:
This build is only available in the Citrix Downloads page.

What's new

  • This release addresses some issues to improve the overall performance and stability.
  • EPA libraries are updated to 26.5.1.0 (OPSWAT OESIS library version 4.3.5495.0).

Fixed issues

  • SSH termination and direct traffic access issues might occur when Citrix Secure Access is connected and contextual routing is enabled.
  • Users might experience a failure to re-establish the connection when switching networks.

V26.04.1.1 (Apr 28, 2026)

Important:
The 26.04.1.1 build is available in the Citrix Downloads page.

What's new

  • Custom workspace domains for accessing applications
    Citrix Secure Access client now supports custom workspace domains. This feature allows organizations to provide users with access to SaaS and private web applications through a branded, organization-owned domain (for example, workspace.company.com) instead of the default *.cloud.com domain. Admins can configure a custom domain as the authentication and access endpoint for browser-based applications delivered via Chrome Enterprise Premium and Citrix Secure Private Access. End users benefit from a seamless, branded experience while organizations gain greater control over access and security. For details, see Custom workspace domains for accessing apps.
  • This release addresses issues to improve the overall performance and stability.

Fixed issues

  • Mac devices disconnect from the Citrix Secure Access client when the enable_vpn_dnstruncate_fix configuration parameter is set to 0, resulting in VPN stability and user connectivity issues.
  • EPA libraries are updated to 26.3.1.0 (OPSWAT OESIS library version 4.3.5186.0).

V25.11.2 (Apr 08, 2026)

Important:
This build is only available in the App Store.

What's new

This release addresses issues to improve the overall performance, security, and stability.

V26.01.1.1 (Feb 09, 2026)

What's new

  • Auto Update feature support
    The Citrix Secure Access application for macOS can now automatically update the client to the latest available version through an Auto Update feature that provides the following functionalities:
    • Periodically checks for updates.
    • Updates the app after notifying the user automatically.
    This feature is not enabled by default. To enable Auto Update support, contact Citrix Support. For more information, see the Auto Update support for macOS.
    Note:
    Because the Auto Update feature is introduced in the version 26.01.1.1, the administrators can use this feature in the subsequent releases.
  • EPA libraries are updated to 26.1.1.0 (OPSWAT OESIS library version 4.3.4910.0).

V25.11.1 (Dec 10, 2025)

Important:
The 25.11.1 build is available in the App store.

What's new

  • EPA libraries are updated to 25.10.1.0 (OPSWAT OESIS library version 4.3.4523.0).

Fixed issues

  • The Citrix Secure Access client crashes intermittently due to incorrect DNS handling.
  • Users might be unable to access intranet applications through the Citrix Secure Access app if the DNS response contains CNAME records. To enable CNAME record handling for the Citrix Secure Access client, contact Citrix Support.

Known issues

  • On macOS 26 devices, the Citrix Secure Access application might repeatedly prompt for file system permissions after a first‑time installation. Prompts can appear during operations such as establishing VPN connections or performing EPA checks. This behavior is due to a macOS issue and is not caused by the Citrix Secure Access application.

V25.11.1.1 (Dec 05, 2025)

Important:
The 25.11.1.1 build is available in the Citrix Downloads page.

What's new

  • EPA client plug-in integration with the Citrix Secure Access application
    The macOS Citrix Secure Access application, distributed as a .pkg file, now includes the EPA client plug-in. This means the plug-in is automatically installed when users install the application.
  • Enhanced client certificate authentication
    During client certificate authentication, Citrix Secure Access automatically selects the client certificate based on the CA certificates configured on NetScaler Gateway. For more information, see Configuring Client Certificate Authentication.
  • EPA libraries are updated to 25.10.1.0 (OPSWAT OESIS library version 4.3.4523.0).

Fixed issues

  • The Citrix Secure Access client crashes intermittently due to incorrect DNS handling.
  • Users might be unable to access intranet applications through the Citrix Secure Access app if the DNS response contains CNAME records. To enable CNAME record handling for the Citrix Secure Access client, contact Citrix Support.

Known issues

  • On macOS 26 devices, the Citrix Secure Access application might repeatedly prompt for file system permissions after a first‑time installation. Prompts can appear during operations such as establishing VPN connections or performing EPA checks. This behavior is due to a macOS issue and is not caused by the Citrix Secure Access application.

V25.08.1.2 (Oct 23, 2025)

Important:
The build 25.08.1.2 is available in the Citrix Downloads page.

What's new

  • PureAuth app support on the Citrix Secure Access client
    The Citrix Secure Access client now supports PureAuth app launch on macOS devices when configured for authentication.

V25.08.2 (Oct 22, 2025)

Important:
The build 25.08.2 is available in the App Store.

What's new

  • PureAuth app support on the Citrix Secure Access client
    The Citrix Secure Access client now supports PureAuth app launch on macOS devices when configured for authentication.

V25.08.1.1 and V25.08.1 (Sep 17, 2025)

Important:
  • If you are using the latest Apple OS versions such as macOS 26 (Tahoe) and later, then we recommend that you upgrade to the Citrix Secure Access client version 25.08.1.1/25.08.1 or later. For more information about the NetScaler Gateway client software requirements, see System requirements.
  • The build 25.08.1.1 is available in the Citrix Downloads page and the build 25.08.1 is available in the App Store.

What's new

  • Route TCP DNS queries to the application-specific resource location
    The TCP DNS queries for specific host names can now be routed directly to the resource location configured in the corresponding application. This routing improves application performance by ensuring that DNS queries reach the most relevant resource location. Previously, all TCP DNS queries were, by default, routed to the geographically closest resource location, regardless of the application’s actual location.
  • SNI support for the Citrix Secure Access client
    The Citrix Secure Access client now sends the Server Name Indication (SNI) field as part of the TLS handshake. This feature is enabled by default. To disable SNI support, contact Citrix Support.
  • Okta Verify app support on the Citrix Secure Access client
    The Citrix Secure Access client now supports the Okta Verify app launch on macOS devices when configured for authentication.
  • EPA libraries are updated to 25.08.1.0 (OPSWAT OESIS library version 4.3.4253.0).

V25.07.1 (Aug 12, 2025)

Important:
This build is only available in the App Store.

What's new

  • Support for multi-workspace URLs
    The Citrix Secure Access client for macOS now supports multi-workspace URLs, allowing administrators to configure multiple access points within the Citrix Cloud environment. This feature is useful for enterprises that must provide different access URLs for various user groups, such as HR, IT, contractors, or vendors. For more information, see Configure Workspace URLs.
  • EPA libraries are updated to 25.07.1.0 (OPSWAT OESIS library version 4.3.4141.0).

V25.07.1.1 (Aug 12, 2025)

Important:
This build is only available in the Citrix Downloads page.

What's new

  • Support for multi-workspace URLs
    The Citrix Secure Access client now supports multi-workspace URLs, allowing administrators to configure multiple access points within the Citrix Cloud environment. This feature is useful for enterprises that must provide different access URLs for various user groups, such as HR, IT, contractors, or vendors. For more information, see Configure Workspace URLs.
  • EPA libraries are updated to 25.07.1.0 (OPSWAT OESIS library version 4.3.4141.0).

V25.06.1.2 (Jul 16, 2025)

Important:
This build is only available in the Citrix Downloads page.

What's new

  • This release addresses some issues to improve the overall performance and stability.

V25.06.2 (Jul 10, 2025)

Important:
This build is only available in the App Store.

What's new

  • This release addresses some issues to improve the overall performance and stability.

V25.06.1.1 (Jul 09, 2025)

Important:
This build is released for the Citrix Secure Access client for macOS and is only available in the Citrix Downloads page.

What's new

  • Support for the Citrix Secure Access client for macOS
    You can now download and install the application using either the package (.pkg) file available at <https://www.citrix.com/downloads/citrix-secure-access/plug-ins/citrix-secure-access-client-for-macOS.html> or from the App Store. The .pkg file can be installed either manually or using management tools like Jamf and Intune.
    Prerequisites
    Before installing the .pkg file for the Citrix Secure Access app, ensure that the following prerequisites are fulfilled:
    • The Mac computer is running on macOS 13.0 or later.
    • The user has administrator privileges on the Mac computer. On managed machines, administrators must ensure that application installation permissions are enabled and the system extension with the identifier "com.citrix.NSG.macos.app.vpnplugin" is activated.
    • Log out of the Citrix Secure Access app if it's currently running.
    • Delete any previously installed App Store version of the Citrix Secure Access app.
    How to install the Citrix Secure Access app on macOS:
    Important
    The Citrix Secure Access app's .pkg file uses the system extension with the identifier "com.citrix.NSG.macos.app.vpnplugin" for VPN connections. For client certificate authentication, certificates must be installed in the System Keychain because macOS system extensions cannot access certificates from the login Keychain.
    1. Download the .pkg file from <https://www.citrix.com/downloads/citrix-secure-access/plug-ins/citrix-secure-access-client-for-macOS.html>.
    2. Install the application using the management tool (Jamf or Intune) or manually. To install the application manually, double-click the .pkg file and follow the on-screen instructions.
    First-time setup:
    After installing the Citrix Secure Access app, perform the following instructions to use the Citrix Secure Access app from your macOS device:
    1. Open the Applications folder and double-click the Citrix Secure Access app icon to launch it.
    2. On the first launch, the system prompts for permission to install the system extension. Click OK on the system prompt.
      If the system prompt does not appear, go to System Settings to enable the installation of the system extension with the identifier "com.citrix.NSG.macos.app.vpnplugin".
      • For macOS 14.x, the System Settings option is under the Privacy & Security tab.
      • For macOS 15.x and later, the System Settings option is under the Login Items & Extensions -> Network Extensions.

V25.06.1 (Jul 09, 2025)

Important:
This build is only available in the App Store.
  • EPA libraries are updated to 25.06.1.0 (OPSWAT OESIS library version 4.3.4025.0).
  • This release addresses some issues to improve the overall performance and stability.

V25.03.4 (May 14, 2025)

What's new

  • This release addresses some issues to improve the overall performance and stability.

V25.03.3 (May 12, 2025)

What's new

  • This release addresses some issues to improve the overall performance and stability.

V25.03.2 (May 08, 2025)

What's new

  • This release addresses some issues to improve the overall performance and stability.

V25.03.1 (Apr 10, 2025)

What's new

  • Hybrid data path support for Secure Private Access service
    The Citrix Secure Access client now supports a hybrid data path in the Secure Private Access service, using both on-premises and cloud infrastructures to provide secure access to applications. You can configure applications to be routed either through the Cloud Connector or the on-premises NetScaler Gateway. For more information, see Hybrid data path for Secure Private Access service.
  • EPA libraries are updated to 25.03.1.0 (OPSWAT OESIS library version 4.3.3980.0).
  • This release addresses some issues to improve the overall performance and stability.

V25.02.1 (Mar 14, 2025)

What's new

  • This release addresses some issues to improve the overall performance and stability.

Fixed issues

  • The Citrix Secure Access client might fail to function with third-party Secure Web Gateways if the User-Agent string in the WebView used during sign-on does not include the correct identifier.

V25.01.2 (Feb 18, 2025)

What's new

  • This release addresses some security-related issues and enhances the overall performance of the application.

V25.01.1 (Jan 16, 2025)

What's new

  • Server-initiated connection support from Secure Private Access
    The Citrix Secure Access client for macOS now supports a server-initiated connection from Citrix Secure Private Access. This feature enables users to configure a policy that allows an application to open a TCP connection to the endpoint. For more information, see Support for server-to-client connections - Preview.
  • EPA libraries are updated to 25.01.13.16 (OPSWAT OESIS library version 4.3.3910.0).

Fixed issues

  • The Citrix Secure Access client on devices running macOS 15.2 and above might fail to complete the configured OPSWAT scans.

V24.11.1 (Nov 25, 2024)

What's new

  • Monitor TCP application session activity in Citrix Director
    The Citrix Secure Access client for macOS now sends TCP application session activity to Citrix Director for both cloud and on-premises deployments of Citrix Secure Private Access.
  • Monitor session activity events in Citrix Director
    The Citrix Secure Access client for macOS now sends summarized session activity events such as successful app launches, app launch failures, and DNS failures, to Citrix Director for both cloud and on-premises deployments of Citrix Secure Private Access.
  • Support for contextual access feature in Secure Private Access
    The Citrix Secure Access client supports the contextual access feature that enables an admin to enforce ZTNA policies dynamically based on the user context like network location, geo location, and device posture. For more information, see Context-based app routing and resource locations selection.
  • EPA libraries are updated to 24.11.1.0 (OPSWAT OESIS library version 4.3.3820.0).

V24.10.1 (Oct 17, 2024)

What's new

  • Support to exclude DNS traffic by Citrix Secure Access client
    You can now configure the Citrix Secure Access client to exclude DNS traffic from being intercepted. For more information, see Exclude specific domain traffic from client interception.
  • EPA libraries are updated to 24.09.1.0 (OPSWAT OESIS library version 4.3.3750.0).
  • This release addresses some issues to improve the overall performance and stability.

V24.09.1 (Sep 16, 2024)

Important:
If you are using the latest Apple OS versions such as macOS 15 and later, then we recommend that you upgrade to Citrix Secure Access client version 24.09.1 or later. For more information about the NetScaler Gateway client software requirements, see Citrix Secure Access client system requirements.

What's new

  • System notifications support for Secure Private Access
    The Citrix Secure Access client now supports system notifications for on-premises deployment of Secure Private Access.
  • EPA libraries are updated to 24.08.1.0 (OPSWAT OESIS library version 4.3.3709.0).
  • This release addresses some issues to improve the overall performance and stability.

V24.08.1 (Aug 14, 2024)

What's new

  • This release addresses some issues to improve the overall performance and stability.

V24.07.1 (Jul 15, 2024)

What's new

  • EPA libraries are updated to 24.06.1.0 (OPSWAT OESIS library version 4.3.3612.0).
  • This release addresses some issues to improve the overall performance and stability.

V24.06.2 (Jun 27, 2024)

What's new

This release addresses the IPv6 login issues.

V24.06.1 (Jun 24, 2024)

What's new

  • This release addresses the TunnelVision vulnerabilities described in CVE-2024-3661.
  • This release addresses some issues to improve the overall performance and stability.
  • EPA libraries are updated to 24.05.2.0 (OPSWAT OESIS library version 4.3.3586.0).
  • EPA scan to check Citrix Workspace™ app version
    Citrix Secure Access supports a new EPA scan CWA Version, that verifies the Citrix Workspace version on macOS machines. For details about the supported EPA scans, see Expression strings.
  • Interoperability enhancements with third-party secure web gateway
    The User-Agent strings for Citrix Secure Access have been updated for an enhanced interoperability with third party Secure Web Gateways.

Fixed issues

  • Citrix Secure Access fails to bypass the VPN tunnel for the excluded apps, if a per-app VPN with reverse split tunneling is enabled.

24.6.1 EPA client for macOS (Jun 18, 2024)

What's new

  • EPA scan to check Citrix Workspace app version
    Citrix EPA client supports a new scan, "CWA Version", that verifies the Citrix Workspace version on macOS machines. For details about the supported EPA scans, see Expression strings.

V24.04.1 (Apr 18, 2024)

What's new

  • EPA libraries are updated to 24.04.1.0 (OPSWAT OESIS library version 4.3.3503.0).
  • This release addresses some issues to improve the overall performance and stability.

V24.03.1 (Mar 14, 2024)

What's new

  • EPA libraries are updated to 24.03.1.0 (OPSWAT OESIS library version 4.3.3460.0).
  • Automatic single sign-on (SSO) to Citrix Secure Access through Citrix Workspace app - Preview
    Citrix Secure Access for macOS now supports automatic single sign on (SSO) to Citrix Secure Access when you log on to Citrix Workspace app. Ensure that you use Citrix Secure Access for macOS 24.03.1 and Citrix Workspace app for Mac 2402 and above, to leverage this functionality. This feature is supported only on cloud stores and not for on‑premises stores.
  • Overall performance and stability improvements
    Citrix Secure Access client is enhanced with the following capability to improve the overall performance and stability:
    • An improved VPN connection resiliency with IPv6 gateways.

V24.02.1 (Feb 15, 2024)

What's new

  • Support for EPA scan operators on Mac clients
    Citrix Secure Access client for macOS now supports all the operators <, >, >=, <=, ==, and != on the EPA editor. Also, the Mac OS option is available as a separate option on the EPA editor (Mac > Mac OS). You can perform a product version scan of your macOS devices using these operators.
    For details, see the Note section in Advanced Endpoint Analysis scans.
  • EPA libraries are updated to 24.1.2.1 (OPSWAT OESIS library version 4.3.3405.0).
  • This release addresses some issues to improve the overall performance and stability.

24.1.5 EPA client for macOS (Feb 12, 2024)

What's new

  • EPA support for Mac devices with Apple silicon processor
    Citrix EPA client now supports Mac devices that use the Apple silicon processor. Mac devices no longer require Rosetta to be installed to run the Citrix EPA client.
  • Support for EPA scan operators on Mac clients
    Citrix EPA client for Mac now supports the operators (<, >, >=, and <= ) in the EPA expressions. Admins can configure EPA scans to allow a wide range of OS versions.
    For example, to allow the OS versions from 12.4 to 13.0, except 12.8, admins can configure the expression version >= 12.4 && version <= 13.0 && version != 12.8. This means that the macOS version must be from 12.4 to 13.0 but cannot be 12.8.
    For details, see Advanced Endpoint Analysis scans.

V23.12.2 (20 Dec 2023)

What's new

This release addresses issues to improve the overall performance and stability.

V23.12.1 (06 Dec 2023)

What's new

  • EPA libraries are updated to 23.11.1.5 (OPSWAT OESIS library version 4.3.3318.0).
  • This release addresses other issues to improve the overall performance and stability.

V23.11.2 (01 Nov 2023)

What's new

EPA libraries are updated to 23.11.1.1 (OPSWAT OESIS library version 4.3.3279.0).

V23.11.1 (27 Oct 2023)

What's new

  • EPA libraries are updated to 23.10.1.1 (OPSWAT OESIS library version 4.3.3246.0).
  • This release addresses the following:
    • Connection issues with the Citrix Secure Private Access™ environment.
    • Other issues to improve the overall performance and stability.

V23.10.2 (17 Oct 2023)

This release addresses the IPv6 login issues.

V23.10.1 (09 Oct 2023)

What's new

  • EPA libraries are updated to 23.9.1.2 (OPSWAT OESIS library version4.3.3221.0).
  • Support for Local LAN access
    Citrix Secure Access for macOS now support the Local LAN access functionality of NetScaler Gateway. You can configure local LAN access so that once a VPN connection is established, end users are either allowed to or blocked from accessing local LAN resources on their client devices. For more information, see the following:

V23.09.1 (07 Sep 2023)

Important:
If you are using the latest Apple OS versions such as macOS 14 and later, then we recommend that you upgrade to Citrix Secure Access client version 23.09.1 or later. For more information about the NetScaler Gateway client software requirements, see Citrix Secure Access client system requirements.

What's new

  • EPA libraries are updated to 1.3.9.9 (OPSWAT OESIS v4.3.3160).
  • Secured connection insights on the UI
    On the "Connections" screen of the Citrix Secure Access client UI, you can view the secured connection details. The details include the IP address, FQDN, destination port, and the duration of the connection. For more information, see Secured connection insights.
  • Reauthenticate with NetScaler Gateway after a VPN connection failure
    Citrix Secure Access client for macOS now prompt you to reauthenticate with NetScaler Gateway when a VPN connection is lost. You are notified on the UI indicating that the connection to NetScaler Gateway is lost and that you must reauthenticate to resume the connection. For more information, see Reconnect to NetScaler Gateway from macOS after a VPN connection failure.

V23.08.1 (24 Aug 2023)

What's new

  • This release addresses issues that help to improve overall performance and stability.
  • EPA libraries are updated to 1.3.9.9 (OPSWAT OESIS v4.3.3122).

23.7.6 EPA client for macOS (10 Aug 2023)

This release addresses issues that help to improve overall performance and stability.

V23.07.1 (17 Jul 2023)

What's new

  • Enhancements to Logs page
    The Logs page of Citrix Secure Access for macOS is enhanced with the following options:
    • Maximum number of log files: Specify the maximum number of log files that you want to add for log collection.
    • Email logs: Send the logs over email.
    For more information, see Send logs.

Fixed issues

When connecting to VPN, if you are prompted to select a certificate for authentication, then the authentication login screen appears behind the Citrix Secure Access client's home page.

V23.06.1 (07 Jun 2023)

What's new

  • Help menu on the navigation bar
    A Help menu is now added to the navigation bar of the Citrix Secure Access client. The options (Open Logs, Export Logs, Email Logs, and Clear Logs) in the Help menu can be used for debugging logs.
    An Email Logs option is introduced under the Help menu. It can be used to share the logs over email. For more information, see Send logs.

Fixed issues

In some cases, the DNS short name resolution fails on Citrix Secure Access for macOS.

Known issues

In some cases, the excluded routes in reverse split-tunneling are tunneled.

V23.05.2 (11 May 2023)

Fixed issues

After an upgrade, the Citrix SSO for iOS client devices cannot establish per-app VPN connections.

V23.05.1 (04 May 2023)

What's new

  • EPA libraries are updated to 1.3.9.3 and OPSWAT libraries are updated to 4.3.2987.
  • Support for sending events to Citrix Analytics
    Citrix Secure Access for macOS now supports sending events such as session creation, session termination, and app connection to Citrix Analytics service. These events are then logged in the Secure Private Access service dashboard.

Fixed issues

  • When the users are connected to Citrix Secure Access or Citrix SSO, the "Connection Duration" field fails to display the time in the region-specific format.

V23.04.1 (04 Apr 2023)

What's new

  • EPA libraries are updated to 1.3.9.1 and OPSWAT libraries are updated to 4.3.2923.

V22.12.2 (27-Feb-2023)

What's new

  • EPA libraries are updated to 1.3.8.9 (OPSWAT OESIS v4.3.2892.0).

V22.12.1 (07-Dec-2022)

This release addresses issues that help to improve overall performance and stability.

V22.11.1 (29-Nov-2022)

Fixed issues

  • Transfer logon does not work for non-nFactor authentication with on-premises gateways.

22.11.3 EPA plug-in for macOS (28-Nov-2022)

Fixed issues

  • Citrix EPA plug-in for macOS crashes when GSLB is enabled on NetScaler.

V22.10.1 (17-Nov-2022)

What's new

  • The Citrix Endpoint Analysis plug-in now supports new MAC address validation expression where pattern sets can be created for the list of allowed IP addresses.

Fixed issues

  • Sometimes, empty proxy settings in NetScaler Gateway release 13.0 or 13.1 causes Citrix SSO to create improper proxy settings.
  • Sometimes, VPN clients fail to reconnect after a network outage or after the device wakes up from sleep mode.
  • Sometimes, gateway connections fail when using IPv6 literals as the destination.

22.10.1 EPA plug-in for macOS (27-Oct-2022)

What's new

  • The Citrix Endpoint Analysis plug-in now a supports new MAC address validation expression where pattern sets can be created for the list of allowed IP addresses.
  • The Citrix Endpoint Analysis plug-in sends duplicate consent alerts while handling private network access preflight requests from Google Chrome.

V22.06.1 (20-Sep-2022)

What's new

  • EPA libraries are updated to 4.3.2523.0 (1.3.7.5)

Fixed issues

  • nFactor authentication with EPA scan does not work on the macOS clients.
  • On the Secure Access Agent home page for macOS, extra padding with white or black color appears on the left and top of the hamburger menu depending on the selected theme (light or dark).
  • When logging into the VPN, the WebView window minimizes on the first try if the device certificate is configured.
  • Endpoint analysis does not work for the Citrix Secure Access app on the macOS client when GSLB is enabled on the NetScaler appliance.
  • If there is a space in the configured application name and you try to access the app, the Enhanced Security Enabled popup does not show up on the macOS clients.
  • On a Mac device using Chrome, the VPN extension crashes while accessing two FQDNs.
  • Citrix Secure Access crashes when an incorrect location value is received from the gateway. This can happen if the administrator defines a responder policy to redirect to another host.
  • Direct connections to the resources outside of the tunnel established by Citrix Secure Access might fail if there is a significant delay or congestion.

V3.2.4.9 - EPA plug-in for macOS (01-Aug-2022)

Fixed issues

  • Citrix Endpoint Analysis plug-in does not handle private network access preflight requests from the Google Chrome browser version 104.
  • Citrix Endpoint Analysis plug-in for macOS does not support GSLB.

Known issues

  • Citrix Endpoint Analysis plug-in for macOS displays a duplicate consent dialog box when started from the Google Chrome browser version 104. The users have to accept both the prompts.

V22.03.1 (14-Jun-2022)

What's new

  • EPA libraries are updated to 4.3.2393.0.

Fixed issues

  • An extra DNS domain is added to the search list. This is because, when the split tunnel is set to "Split" or "Both" only the specified domains and their subdomains are NOT tunneled. If the specified domain is A.B.C, then B.C is also matched in addition to A.B.C and *.A.B.C.
  • HTTP/HTTPS proxy settings that do not use a PAC file are broken.

V22.02.3 (24-Mar-2022)

What's new

  • Citrix Secure Access for macOS resolves the FQDN of a service node on every TCP data connection from the client for the cloud workspace connections. Resolving the FQDN of a service node on every TCP data connection is not applicable for the on-premises gateway connections.

Fixed issues

  • Sometimes, the Citrix Secure Access for macOS drops connections because of issues with some non-DNS protocols using port 53, such as STUN.
  • The Citrix Secure Access app breaks some protocols when the server sends data before the client, immediately after the connection is established.
  • If the user closes the authentication window of the Citrix Secure Access client for macOS without completing the authentication, then subsequent attempts to connect to the server fail until the app is restarted.
  • The Citrix Secure Access client for macOS is now bundled with OPSWAT library version 4.3.2367.0
  • Citrix Secure Access for macOS takes a longer time than expected to run the post-authentication EPA check.

Known issues

  • Citrix Secure Access app for macOS logs out one minute after the already connected Citrix Secure Private Access service region becomes unreachable. However, this does not affect the on-premises gateway connections.

V22.02.2 (15-Feb-2022)

Fixed issues

  • Multiple pop-ups are displayed when a user tries to access an unsubscribed Web app from Citrix Secure Access for macOS.

V1.4.1 (28-Jan-2022)

what's new

  • The Citrix SSO app for macOS is now rebranded as Citrix Secure Access.

Fixed issues

  • Client certificate authentication fails if the authentication server requests for the client certificate multiple times in the same web view session.
  • Citrix SSO fails to establish a VPN connection if the server certificate has only an IP address for common name because of a proxy in between the client and the ADC.
  • EPA scan for checking the antivirus last full system scan fails on macOS.
  • Sometimes, the Citrix SSO app crashes while handling large DNS packets.

V1.4.0 (17-Nov-2021)

Fixed issues

  • Sometimes, the server validation code fails when the server certificate is trusted. As a result, end users cannot access the gateway.
  • Citrix SSO fails to re-establish the VPN connection after network disruption.

V1.3.13 (05-Nov-2021)

Fixed issues

  • You might experience failures when filtering sessions for managed versus unmanaged VPNs. The initial requests to establish the session are missing the "ManagedVpn" information in the User-Agent header.

V1.3.12 (21-Oct-2021)

Fixed issues

  • Client certificate authentication fails for Citrix SSO for macOS if there are no client certificates in the macOS Keychain.
  • The Citrix SSO app crashes intermittently when receiving notifications.
  • The VPN extension might crash when the "isFeatureEnabled" parameter is called to check a feature flag.
  • The gateway VPN extension crashes if the DTLS protocol has an empty payload.
  • The SSO app crashes intermittently when the device wakes up from the sleep mode and the VPN is connected.

V1.3.11 (17-Sep-2021)

Fixed issues

  • EPA scan for firewall check fails for macOS devices using Citrix SSO.
  • Citrix SSO crashes in an iOS 12 device when legacy authentication or Intune Network Access Compliance (NAC) is configured.

V1.3.10 (31-Aug-2021)

What's new

  • Citrix SSO for macOS is now bundled with OPSWAT library version 4.3.1977.0.

V1.3.9 (13-Aug-2021)

Fixed issues

  • On some systems with HTTP proxy software installed, the NetScaler Gateway IP address shows up internally as 127.0.0.1 thus preventing tunnel establishment.
  • Citrix SSO cannot connect to systems where the DNS name does not match the common name in the server certificate. Citrix SSO now checks for the subject alternative names, and connects correctly.

V1.3.8 (07-Jul-2021)

What's new

  • Citrix SSO for macOS is compatible with versions 10.15 (Catalina) and higher only.
  • Starting from Citrix SSO for macOS version 1.3.8, the EPA libraries are embedded within the app and are not downloaded from the NetScaler Gateway server. The current embedded EPA library version is 1.3.5.1.