After the deployment
When Azure reports that the deployment succeeded, Citrix SecurSpaces™ is running but nothing works yet. That is expected. Two things remain, and neither happens on its own:
-
The hostname does not resolve. You create the DNS records.
-
The platform is unlicensed. You sign in and choose Community Edition.
Read the deployment outputs
The managed application keeps its outputs for as long as it exists. In the Azure portal, open the managed application, then select Parameters and Outputs.
| Output | What it is |
|---|---|
portalUrl |
The address you sign in to |
dnsTarget |
Contributor path: the target of both CNAME records |
dnsRecords |
Contributor path: the two record names to create |
nameServers |
Owner path: the four name servers for the NS record set |
managedResourceGroup, aksClusterName |
The names used by the renewal and uninstall procedures |
To read them from a terminal:
az managedapp list --query "[].{name:name, resourceGroup:resourceGroup}" -o table
az managedapp show -g <resource-group> -n <name> --query properties.outputs -o json
On the Owner path, the four name servers are also shown on the Overview page of the DNS zone in the managed resource group.
Create the DNS records
Create the records in the zone that holds the parent of your hostname.
Owner path: one NS record set
Create one
NS record set named after your hostname, with the four name servers from the outputs as its values. For example, for securspaces.apps.example.com in the zone apps.example.com, the record set name is securspaces.
This is the only DNS change you make. The certificate is issued a few minutes after the delegation resolves, and renewed automatically from then on. Until it is issued, the platform does not answer on HTTPS.
Contributor path: two CNAME records
Create two
CNAME records, both pointing at dnsTarget:
| Name | Example | What it serves |
|---|---|---|
<hostname> |
securspaces.apps.example.com |
The portal |
*.proxy.<hostname> |
*.proxy.securspaces.apps.example.com |
Every workspace, the coordinator and the SSH endpoint |
Do not create a record for
proxy.<hostname> itself. Nothing is served there.
If your zone is in Azure DNS, record names are relative to the zone:
az network dns record-set cname set-record -g <zone-resource-group> -z apps.example.com \
-n securspaces -c <dnsTarget>
az network dns record-set cname set-record -g <zone-resource-group> -z apps.example.com \
-n '*.proxy.securspaces' -c <dnsTarget>
Quote the asterisk, or the shell expands it.
Check the records at the zone's own name servers
If anything looked up these names before they existed, resolvers cache the "does not exist" answer, commonly for up to an hour. A correct record can therefore appear to be missing, sometimes intermittently. Do not edit or recreate it. Ask the zone's own name servers instead, which answer correctly as soon as the record is written:
dig +short NS apps.example.com
dig +norecurse @<one-of-those-name-servers> securspaces.apps.example.com NS
dig +norecurse @<one-of-those-name-servers> securspaces.apps.example.com CNAME
Use the
NS query on the Owner path and the CNAME query on the Contributor path.
Sign in and license the platform
Open
portalUrl and sign in with the administrator email and password you entered in the wizard.
Enroll in two-factor authentication
Two-factor authentication is mandatory for the administrator and comes first, before any other page.
-
Scan the QR code with a TOTP authenticator app, such as Microsoft Authenticator, Google Authenticator or 1Password.
-
Enter the six-digit code and select Confirm.
Important:
The secret is stored only on the device you scanned with, and there are no recovery codes. Resetting two-factor authentication needs a session on the account or another administrator. Create a second administrator as soon as you are signed in. If the only administrator loses their device, nobody can sign in.
Choose Community Edition
You are sent to the Set Up Configuration wizard. Its first step is License.
-
Select Community Edition. The license is fetched immediately, with no confirmation dialog.
-
Complete the remaining steps, or skip them: Register Sign-In Domain, Code Repository Applications and Organization.
The License step cannot be skipped. If the wizard moves on, the platform is licensed. After the wizard, the platform shows a Community Edition banner.
The Community Edition option exists only in this wizard. The Configuration > License page offers Online License and File License only.
Verify HTTPS
HOST=securspaces.apps.example.com
openssl s_client -connect "$HOST:443" -servername "$HOST" </dev/null 2>/dev/null \
| openssl x509 -noout -subject -dates -ext subjectAltName
openssl s_client -connect "test.proxy.$HOST:443" -servername "test.proxy.$HOST" </dev/null 2>/dev/null \
| openssl x509 -noout -subject -dates
The first command must list both names. The second must return the same certificate, even though no workspace called
test exists. Do not use kubectl get svc to check: the load balancer lists port 443 whether or not a certificate is served.
Certificate expiry warnings
The platform reads the certificates it serves and warns at 30, 14 and 7 days before expiry, and again after expiry. Warnings appear as a notification to administrators, a banner for every signed-in user, and an entry in the platform audit log. No email is sent.
On the Owner path, renewal starts about 30 days before expiry. A warning at 14 or 7 days means renewal is failing: check the
NS delegation and any CAA record on the parent zone.
On the Contributor path, put the renewal date in a calendar as well. See Renew the TLS certificate.
Next steps
The project overview shows a Setup Checklist: review container images, add a code repository, configure secrets, create a workspace template, and add users. Before you add users, read Community Edition.