Chrome Workspace App

  

When i trying to update workspace (recently added new button by Ganesh Swamypillai), some of my workspaces are not updated at all (those that contain many tabs), while others add new tabs, but do not update old ones. Sometimes old tabs are updated and the same old tabs are added to the workspace, that is, they are copied. In a word, hell is. Privacy and legal terms; Do Not Sell My Personal Information; Cookie preferences; © 1999-2021 Citrix Systems, Inc. All rights reserved.

downloadWhy can't I download this file?

Applicable Products

  • Receiver for HTML5
  • Receiver for Chrome

Symptoms or Error

Connection to StoreFront/VDA will fail and may show cannot connect to server error or some SSL Certificate error in console logs. One of the reason could be invalid SSL certificate.

Applicable Products:

Citrix Receiver for HTML5, Citrix Receiver for Chrome, Citrix Workspace app for Chrome, Citrix workspace app for HTML5

Solution

Recommended solution: Update the certificates.

Alternatively, you can try this workaround:

  1. Close the Citrix Workspace app for Chrome / Citrix Receiver for Chrome.

  2. Top rated subcompact suv. Open Chrome browser in your Chromebook.

  3. Visit your site.

  4. It will show some error as below.

Now, open the Citrix Workspace app for Chrome or Citrix Receiver for Chrome and it might allow you to access your StoreFront/VDA.

Other possible workaround for specific certificate error:

  1. NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM error
    Latest Firefox and Chrome browsers do not support SHA-1 certificate and StoreFront connection fails with error: NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM
    Citrix Receiver for Chrome/HTML5 or Citrix Workspace app for Chrome/HTML5 cannot establish secure connection and session launch will fail

  2. NET::ERR_CERT_COMMON_NAME_INVALID error
    Chrome requires Subject Alternative Name for SHA-2 certificate, without SAN (Subject Alternative Name) in the SHA-2 certificate, the connection will fail with error NET::ERR_CERT_COMMON_NAME_INVALID
    Session launch fails with CERT_COMMON_NAME_INVALID(-200) error dialog
    Workaround for NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM and
    NET::ERR_CERT_COMMON_NAME_INVALID:

    • Mozilla:

      Enable network.websocket.allowInsecureFormHTTPS from about:config

    • Chrome:
      Chrome by default requires SHA2 Certificate with Subject Alternative Names (SAN)
      Add the following registry keys at : SoftwarePoliciesGoogleChrome

    • EnableCommonNameFallbackForLocalAnchors – true
      (Note: Chrome need SAN by default)

    • EnableSha1ForLocalAnchors – true
      (Note: SHA1 is not supported)
      Recommended Solution: Use SHA2 certificates with Subject Alternative Names (SAN).

      Problem Cause:

    • CTX134123 - Receiver for HTML5 - Unable to Launch Apps Using HTTPS URL

    • CTX217352 - How to Collect Logs in Receiver for Chrome and Receiver for HTML5

  3. NET::ERR_CERT_SYMANTEC_LEGACY
    From Chrome OS version 66 onwards the SSL certificate from Symantec is distrusted. You can go through https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html to know more about it.
    Workaround: Try general workaround mention above.
    Recommended Solution: Update SSL certificates.

Problem Cause

  • CTX134123 - Receiver for HTML5 - Unable to Launch Apps Using HTTPS URL

  • CTX217352 - How to Collect Logs in Receiver for Chrome and Receiver for HTML5

downloadWhy can't I download this file?Google chrome workspace app

WARNING! This option on Firefox affects the operation of entire Firefox, not just Citrix Receiver for HTML5.

Important Note

As of version 9, Safari browser allows insecure web socket connections. Internet Explorer never allowed non SSL/TLS web socket connections from HTTPS websites. Chrome used to allow it behind a flag, but after the Chrome 44 update, this is no longer supported. Firefox allows it behind a flag (as explained earlier in this article), but it is not recommended. Going forward, only secure (SSL/TLS) web socket connections can be made from Receiver for HTML5.

Problem Cause

When Workspace App for HTML5 is hosted on a https site (default and recommended), non SSL/TLS websocket connections are prohibited by browsers.
In explaining the technical reason behind this it is important to understand the following two principles:
1. As opposed to existing as a separate process, Citrix Workspace App for HTML5 operates within the frame and process space of the browser itself. As such the browser has the ability to enforce certain security parameters.

2. Additionally, when any Workspace App for Windows makes a connection to a VDA for either a published desktop or app, the underlying connection is made to the VDA and not the Storefront server as any kind of intermediate proxy.


This second point is less obvious in the case of Citrix Workspace App for HTML5 because the published desktop or application displays within the browser frame and “appears” to be connected via the Storefront server. Despite this appearance though, the underlying TCP/UDP connection is still between the client and the VDA. If the Storefront base URL is SSL enabled (where it begins with https as is best practice) and the VDA is not SSL enabled (which it is not by default) the browser in this case will prevent the connection due to what it sees as an underlying inconsistency. The inconsistency is that while the URL shown in the browser frame is prefixed with https, the actual underlying connection is not https even though it is not obvious to the user.
There are two solutions for this.
Solution 1 is to enable SSL on the VDA using the following guide:

https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/tls.html
This will ensure that the connection path is SSL enabled between the internal client and the VDA.Workspace
Solution 2 is to have your connections from the clients first go through a Citrix Gateway. Citrix Gateway will proxy the connections and perform a SSL handshake between the client and the Citrix Gateway. In this scenario there is no inconsistency and connections via HTML5 Receiver will succeed.

Additional Resources

Chrome Citrix Workspace App

You can now use the Application probing feature to proactively monitor the health of applications enabling you to fix issues before the user actually experiences them. For more information refer to Citrix Documentation - Application probing.