When you really haven’t chosen not to trust: Citrix, Mac OS X, and Entrust certificates

Written by

NB: this article is a few years old, and I haven’t tested any updates since I wrote it. It may still work; who knows?

This is one that the support desk of my employer really should’ve answered, but they gave their usual, “You mentioned Macintosh in your e-mail, so this conversation stops here” response.

Anyway, they’ve just upgraded their Citrix access, and what used to work now gives the rather cruddy response:

Just what SSL Error 0: You have not chosen to trust “Entrust.net Secure Server Certification Authority”,the issuer of the server’s security certificate. Error number: 183 is supposed to mean to anyone, I don’t know. (Well, actually, I do know, but in rants like this it’s customary to feign ignorance in a huffy manner. Work with me here, people.)

So, to fix this:

Make sure that Citrix ICA Client is installed
Go to entrust.net/developer and click on Download Root Certificates
Select Personal Use, and click on Download Certificates
Download entrust_ssl_ca.cer and entrust_ssl_ca.der to your desktop
Open a terminal (it’s in Applications/Utilities), and enter the following:
cd /Applications/Citrix\ ICA\ Client/keystore/cacerts/
cp -p ~/Desktop/entrust_ssl_ca.* .
ln -s entrust_ssl_ca.cer entrust_ssl_ca.crt
Exit the terminal, and try your Citrix session again.

There might be some unnecessary steps there, and this might all be fixed by downloading the latest release of the ICA client, but this works for me now.

Comments

14 Responses to “When you really haven’t chosen not to trust: Citrix, Mac OS X, and Entrust certificates”

02007-01-04

scruss

This also works under Ubuntu if you substitute the directory /usr/lib/ICAClient/keystore/cacerts/
02007-02-05

scruss

The direct links I gave to entrust_ssl_ca.cer and entrust_ssl_ca.der work fine without going through the ‘Personal Use’ login bit.
02007-06-19

Katie

Thank you so much for you posting. It was awesome.
02007-07-11

Kevin

This was great advice. Easy to follow for a computer novice. Thank you.
02007-08-20

Ben Welter

Thanks very much for posting this. Worked perfectly, saved me a long-distance call to IT support at work.
02007-12-03

scruss

Jason, in step 5, you hit return between each of the lines; there are three separate commands
02008-10-30

27p

Thanks for the fix, don’t think my help-desk would have been much help. Keep up the good work.
02009-01-28

toby johnson

Thanks for the info. FYI, you don’t need the .der certificate, and you can simply rename the .cer to .crt instead of creating a symlink. Just the following worked for me in Ubuntu:

cd /usr/lib/ICAClient/keystore/cacerts
sudo wget https://www.entrust.net/downloads/binary/entrust_ssl_ca.cer
sudo mv entrust_ssl_ca.cer entrust_ssl_ca.crt

And if you think you get blown off when mentioning a Mac, just try mentioning Linux and see if they have even heard of it 🙂
02009-02-16

Ola

Thanks, this didn’t quite work for me but it gave me the right direction. For some reason the entrust_ssl_ca.cer did not load to the desktop, it kept loading in firefox only as a txt file…. so what i ended up doing is moving the entrust_ssl_ca.der file into Applications/Citrix ICA/keystore/cacerts and it worked! thank you 🙂
02009-10-18

Nsrini

Toby johnson’s suggestion of copying the .cer file worked perfectly for me . Thanks for the suggestion
02010-11-04

Tony

The following settings worked for me in Fedora 13.

cd /usr/lib/ICAClient/keystore/cacerts
sudo wget https://www.entrust.net/downloads/binary/entrust_ssl_ca.cer
sudo mv entrust_ssl_ca.cer entrust_ssl_ca.crt

Thanks to all..

Great Great help!!!
02012-06-04

ICAClient Entrust.net error on Ubuntu « [lokman]weblog

[…] If you getting the error below, here is the steps to resolves this (http://scruss.com/blog/2006/12/14/when-you-really-havent-chosen-not-to-trust-citrix-mac-os-x-and-ent…) […]
02014-01-27

Linking â‰ Abuse. | We Saw a Chicken â€¦

[…] the following links are pointing to our website from your site: http://scruss.com/blog/2006/12/ http://scruss.com/blog/2006/12/14/when-you-really-havent-chosen-not-to-trust-citrix-mac-os-x-and-ent… […]
02018-12-04

Icaclient Entrust.net Error on Ubuntu | Infinite Logix

[…] If you getting the error below, here is the steps to resolves this (http://scruss.com/blog/2006/12/14/when-you-really-havent-chosen-not-to-trust-citrix-mac-os-x-and-ent&#8230😉 […]