Install .cer Root and Intermediate CA certs - Netscaler

Everyone knows how to install .pfx certs. Recently I came across a situation to install .cer certs on Netscaler. Everywhere I saw single line of instruction that "install certs using Traffic management --->SSL -->Certs--> Install". I tried that but there is no option  for .cer certs.

Solution:

This solution is applicable for RootCA and Device CA certs only.

1. Login netscaler and go to Traffic Management Tab
2. Go to SSL tab and click Certificates
3. Click install
4. Select name, certificate file, select PEM ( do not select  - Private key file, password)

 5. Click Install


You are done. Have a nice day!!!1

License server has expired. Unable to enroll devices-Citrix Xenmobile

Error: The following error is showing on Citrix Xenmobile Device manage console- "License server has expired "

Solution:

The license server has correct license files. I am able to telnet on license port but console was displaying above error.

I have applied the patch "Patch_900_9997" as recommended in the article http://support.citrix.com/article/CTX141058

Now its working fine.


Have a nice day!

JCE unlimited Strength Jurisdiction Policy is required for iOS MDM to work

Citrix Xenmobile was giving the above error.

Solution:

Download the respect JCE files from Oracle:

Java 7 - http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
Java 8 - http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html

Copy and replace local_policy.jar and US_export_policy.jar from the Unlimited JCEPolicy.zip file to the following location:

C:\Program Files\Java\Jdk1.8.0.45\jre\lib\security
C:\Porgram Files\Java\jr8\lib\security


Have a nice day!

Services down second HA Netscaler Node

 Recently I came across an issue that services were down on second HA Netscaler node. Both Netscalers are in same network. I checked and found that "INC"(Inter Network Connection) was enabled which was causing the services to fail on second node.

How to resolve:

INC should be enabled on HA netscalers when both places on different subnet. In my situation both are in same subnet and I don't need it.

How to remove INC...

1. Take backups of Netscaler conf file
2. Break HA by removing second node from Primary node cluster on Primary
3. Break HA by removing primary node from Secondary node cluster on Secondary
3. System -->High Availability --->edit the node as Stay Primay on node where services are running good
4.System -->High Availability --->edit the node as Stay Secondary on node where services are down
5. Remove SNIP address from Network IPs from Secondary node
6. Create HA cluster on  Primary node by adding secondary node and deselected "INC"
7. run  Action ---> force synchronization
8. Check services on both nodes and they should be okay now
9. Remove Stay Primary and Stay Secondary and Enable active participation.
10. save the configuration


Have a nice day!

Desktop Sync & Xenmobile SAML for Sharefile-going to green page

I have configured the Citrix App Controller as SAML provider for Sharefile. SAML login in web browser was going to green(Receiver) page and Desktop Sync was also going to green page during configuration.

Solution:

I have reconfigured the Netscaler and app controller as SAML provider for Sharefile using the following article:

http://support.citrixonline.com/en_US/ShareFile/help_files/SF090017?Title=Configure+ShareFile+Single+Sign-On+with+XenMobile#ConfigNSG

Mainly I followed the Netscaler configuration and unchecked the "Redirect to Home Page". Now SAML authentication directing to Sharefile page in web browser and as well in Desktop Sync too.

Have a nice day!

ShareFile SSO multiple (three) Citrix App Controllers SAML configuration

Recently I came across this scenario:

AD domain - Single
ShareFile Sub domain - Single
Citrix MDM Enrollment - 3 URLS (3 deployments for 3 regions)
Citrix App Controllers -3

I have configured region1 Citrix App Controller as SAML provider for Sharefile. In browser, Sharefile SAML login is working fine for all three regions. MDX Sharefile apps from region1 app controller are working fine but MDX Sharefile apps from other regions App controllers' were failing SSO.

Workaround I used:

I have installed wild card cert as SAML cert on all regions' Citrix App controllers. Configured remaining two app controllers (App & Docs--->Docs--->Sharefile) to reflect the Sharefile domain information. After that I sync up the Sharefile configuration (under docs-Sharefile) on region1 App controller. It is working now Sharefile SSO for MDX apps for all regions.

Importing wild card cert as SAML cert:
First I uploaded the wildcard cert(in .pfx) to the app controller as server certificate. I removed the chain links and exported the cert in .pem format from App Controller. I reimported the pem wild card certificate(no chains) to the app controller as SAML cert on all three regions' App Controllers.

Configuring First Citrix App Controller as SAML provider
FYI..As given below I configured the Sharefile SSO on region1 App Controller :
http://ravichallas.blogspot.com/2015/01/mdx-sharefile-app-sso.html


Have a nice day.

MDX Sharefile APP SSO

MDX ShareFile app has been published for end users. But SSO is not working. I had configured PingFederate as IDP provider for Sharefile and Single Sign On is failing.

As per Citrix, MDX Sharefile App supports only Xenmobile(App Controller) SSO only. Hence I have configured Sharefile SSO using the following articles and it worked like gem..

http://blogs.citrix.com/2014/01/16/xenmobile-sharefile-mobile-app-sso-using-saml/

http://support.citrixonline.com/en_US/sharefile/all_files/SF090017

It supports multiple domains too..For that I have added AD authentication domains on both Netscaler(Under gateway--Policies ---Authentication---LDAP) and App controller (settings --Active Directory) and linked them in Netscaler by binding the LDAP policies to Gateway virtual server.

Have a nice Day...