Solution
“Unable to connect to the server. Contact your system administrator with the following error: The Citrix SSL server you have selected is not accepting connections.” I can see in TCPView that it’s trying to connect in port 444, but the session is not established. In the Citrix StoreFront console, right-click Server Group, and click Change Base URL. Enter the new Base URL in format. This URL must match the certificate that is installed on the load balancer. Right-click your store, and click Manage Receiver for Web Sites. Click Configure. Ensure that the STA is specified in the NetScaler Gateway settings. On the NetScaler, navigate to NetScaler Gateway Virtual Servers Published Applications and add the STA. Make sure that it matches the STA that is in the StoreFront server in NetScaler Gateway Secure Ticket Authority. Also ensure to include the path: /scripts/ctxsta.dll. In Citrix StoreFront, finding the PowerShell command that corresponds with an item in the console can be a daunting task. The purpose of this article is translating the Citrix StoreFront console to PowerShell on an per-item basis. The contents of this article, including the screenshots, is based on Citrix StoreFront 3.14 (released in Q1 2018).
Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.
The browser forwards this ICA-File to the Citrix receiver. (Begin of second part!) Citrix receiver will read the ICA file and; connect to the NetScaler Gateway. We can see this as we will see a progress bar. The receiver will send the STA ticket to the NetScaler Gateway. NetScaler Gateway will connect to the STA and try to resolve this ticket.
- Change the Secure Ticket Authority (STA) listed in the StoreFront server from using the fully qualified domain name (FQDN) to the IP address of the XenApp server. If you are using FQDN then always verify that the name can be resolved to the correct IP address of the STA servers.
- Verify that the FQDN name listed in the STA list in StoreFront is the correct FQDN.
- If you are unable to resolve the FQDN then add a host record directly onto to the StoreFront server to bypass any issues with DNS.
- If you made any changes to STA on one of the StoreFront servers then ensure that the changes are propagated to all the other StoreFront servers.
- Verify if the Secure Gateway, Web Interface and XenApp are listening on the same ports using the following information:
Note: When changes are made to the Secure Gateway server, it has to be restarted for the changes to take effect and this will disrupt the sessions of any currently connected users.- Secure Gateway: Run through the Secure Gateway Wizard and confirm that the STAs have the FQDN (or IP) and that the TCP port matches that of Web Interface and XenApp.
- Web Interface: Under the setting for Secure Access, click next until you get to the specify Secure Ticket Authority settings windows and confirm that the STA URLs are using the correct port. If not, highlight the STA, click Edit and adjust the URL to reflect the correct port.
- XenApp: Open a command line and run the command netstat -ano to see if the XenApp server is listening on the same port which is configured on Secure Gateway and Web Interface. If not, run the commands:
net stop w3svc (this will stop IIS)
ctxxmlss /u (this will un-register the existing port in use)
ctxxmlss /r'nn' ('nn' represents the port number which you wish to register. Type it without the quotation marks. For example - ctxxmlss /r8080)
net start w3svc (this will restart IIS)
- Complete the following troubleshooting steps on the ICA file that is received while launching an application:
- Verify if the ICA file has internal server IP address rather than 'gateway FQDN:443' information.
- Verify if the ICA file has NetScaler Gateway FQDN:443 as specified on StoreFront server in NetScaler Gateway settings: SSLProxyHost=gateway-fqdn:443
- Verify that on NetScaler Gateway the STA server is added globally or under vserver, similar to what you have specified on StoreFront Gateway settings. STA should be added on NetScaler Gateway and StoreFront. STA status should show as up on NetScaler Gateway.
- Examine for probable DNS issues. The backend server address should be resolvable from NetScaler Gateway. If not, try adding “A Record” on NetScaler Gateway under “DNS” option.
- If users are not able to launch applications after upgrading Firefox to version 30.0, then refer to article CTX200200 - Unable to Launch Applications from Firefox 30.0
- Check if any XenDesktop servers fail to work as an STA. Remove the failed XenDesktop server as an STA and add another XenDesktop server as STA.
Citrix Receiver For Mac Cannot Connect To Server 40 Sta
Additional Resources
A list containing the majority of Citrix Workspace app for Android (formerly Receiver for Android) support articles collated to make this page a one stop place for you to search for and find information regarding any issues you have with the product and its related dependencies.
The page is updated daily with new support articles and information. Articles will change from time and if information here is outdated or incorrect please let me know using the comments. Links may also expire or change so if you find broken links, please again let me know. For each issue, known product versions affected are recorded however that does not mean product versions that aren’t listed are not affected.
There is a search box that you can use if looking for a specific fault. For example if you have an error code or error message, use that to perform a search. You can also use your browsers search feature which will perform a search against the whole page based on the words you enter.
Receiver for Android / Workspace app for Android:
Citrix Receiver Cannot Connect To Server 40 States
| wdt_ID | Brief Description of Issue | Brief Description of Fix | Applicable Product Versions Affected (if known) | Link to supplemental Support Article(s) |
|---|---|---|---|---|
| 1 | When launching any application you receive error 'Cannot Connect: Error connecting to the session reliability server. Error tunneling through the proxy'. | This could be caused by firewall port blockage either internally or externally via NetScaler. It could also be down to STA servers either not configured on NetScaler or down. | https://support.citrix.com/article/CTX225834 | |
| 2 | As you type into an application such as Word or Notepad, the virtual keyboard appears on screen. Eventually after several lines of text some of that text will begin to dissapear underneath the keyboard. | Citrix are aware of this issue and a solution is under investigation. | https://support.citrix.com/article/CTX223986 | |
| 3 | When adding an account to Receiver for Android that goes through NetScaler Gateway, a Receiver for Web logon page appears instead of showing a list of applications. | Disable 'Set the unified Receiver experience as the default for this store' within StoreFront. | Citrix Receiver for Android 3.9.1. | https://support.citrix.com/article/CTX216410 |
| 4 | The keyboard does not automatically display and users have to manually select it to open. | Check the 'Automatic keyboard display' policy within Citrix Studio is set to 'Allowed'. | https://support.citrix.com/article/CTX220263 | |
| 5 | The keyboard does not automatically display when clicking into an editable area of an application such as Word or Notepad. iOS works fine however Android does not behave the same. | iOS operates differently due to underlying functionality and it is expected for Android Receiver versions to not automatically show the keyboard. | https://support.citrix.com/article/CTX223781 | |
| 6 | Receiver for Android may ask for your password twice when logging on to NetScaler Gateway. | This is a known issue. You should only be prompted for the password twice when setting up the account and not thereafter. | Citrix Receiver for Android 3.11. | |
| 7 | You receive the error message 'The server certificate is not trusted' when connecting to NetScaler Gateway. | Stricter certificate validation checks have been included in Receiver for Android 3.12 and above versions. You must make sure that NetScaler provides the complete certificate chain to clients and that none of the certificates in that chain have expired. | Citrix Receiver for Android 3.12. | https://support.citrix.com/article/CTX224709 |
| 8 | When docking a Samsung S8+ with an existing ICA session to a DeX docking station, the session does not continue on the new display and instead returns error 'Error connecting to the session reliability server' or 'Error tunneling through the proxy'. | Upgrade to Receiver for Android 3.12.2. | https://support.citrix.com/article/CTX227985 | |
| 9 | Receiver for Android might not work properly with NetScaler Gateway integrated with a XenApp Services website. | This is a known issue. Delete and then re-add the account again. | Citrix Receiver for Android 3.13.2. | https://support.citrix.com/article/CTX231776 |
| 10 | When launching a desktop you receive error 'HdxSdkErrorDomain_Session error 8'. | This is resolved in a NetScaler update. | Citrix Receiver for Android. | https://support.citrix.com/article/CTX232099 |