Saturday, September 14, 2013

You have not chosen to trust "DigiCert High Assurance EV Root CA" Fix Ubuntu Linux

So I had to download the new Citrix receiver for my linux browser so I could remote in to some windows machines at work. After downloading the app, installing and logging in with my RSA key I get this error:

"SSL error
Contact your help desk with the folling information:
You have not chosen to trust "DigiCert High Assurance EV Root CA",
the issuer of the server's security certificate (SSL error 61)"

Whaatttt!! Are you serious! How stupid. So if I go to I can test my certificates and they work just fine for the DigiCert High Assurance check, so that means the browser knows where they are but the stupid Citrix app doesn't. So all of the certs are located here in Ubuntu (you have a ton in there):

ls /etc/ssl/certs/ | grep DigiCert

You will see the one you want, now copy it to your Citrix folder:

sudo cp -v /etc/ssl/certs/DigiCert_High_Assurance_EV_Root_CA.pem ~/./ICAClient/linuxx86/keystore/cacerts/

Now try again and it will work, I didn't even have to restart my browser. You could also do a symbolic link instead which is maybe a better practice. 


temps said...

Firefox !!! with certificat

Veracity said...

Thanks. Used in conjunction with another page to get Citrix to load on my Chromebook.

Thanks again; exactly what I was looking for.

Roo said...

thanks Bent
- 2016 and the same problem still exists with citrix receiver !!

Great job thanks for your solution -

for anyone who is a linux newbie and not terminal savvy you can copy the certificate using pcfileman which you may need to install

if you are told you can't paste it into your citrix cacerts folder mine is here :- /opt/Citrix/ICAClient/keystore/cacerts

then right click using pcfileman in wherever your citrix is installed and choose open as root - then you can paste it

Wasif said...

Thanks for the help for mint user copy will require some adjustment

sudo cp -v /etc/ssl/certs/DigiCert_High_Assurance_EV_Root_CA.pem /opt/Citrix/ICAClient/keystore/cacerts/

汪轶颖 said...

Thank you! This post saved my life.

Harry Delien said...

Still works in 2017 running Debian 9. In my case, the command was the same as Wasif said above.