Certificates management on Citrix Gateway

On Citrix Gateway, you use certificates to create secure connections and to authenticate users.

To establish a secure connection, a server certificate is required at one end of the connection. A root certificate of the Certificate Authority (CA) that issued the server certificate is required at the other end of the connection.

• Server certificate. A server certificate certifies the identity of the server. Citrix Gateway requires this type of digital certificate.
• Root certificate. A root certificate identifies the CA that signed the server certificate. The root certificate belongs to the Certificate Authority. A user device requires this type of digital certificate to verify the server certificate.

When establishing a secure connection with a web browser on the user device, the server sends its certificate to the device.

When the user device receives a server certificate, the web browser, such as Internet Explorer checks to see which CA issued the certificate and if the CA is trusted by the user device. If the CA is not trusted, or if it is a test certificate, the web browser prompts the user to accept or decline the certificate (effectively accepting or declining the ability to access the site).

Citrix Gateway supports the following three types of certificates:

• A test certificate that is bound to a virtual server and can also be used for connections to a server farm. Citrix Gateway comes with a pre-installed test certificate.
• A certificate in PEM or DER format that is signed by a CA and is paired with a private key.
• A certificate in PKCS#12 format that is used for storing or transporting the certificate and private key. The PKCS#12 certificate is typically exported from an existing Windows certificate as a PFX file and then installed on Citrix Gateway.

Citrix recommends using a certificate signed by a trusted CA, such as Thawte or Verisign.