Christos Polydorou

I got a call a few days ago to renew the certificate on a Citrix Access Gateway appliance. The appliance was very - and I mean very - old so I had my hands full... After I found out that the proper software for management was installed on the Web Interface servers, I requested the certificate in PFX format in order to get the private key too and scheduled the change for after hours since it requires a restart of the devices. When I tried to install the certificate, the appliances refused to accept it. Then I recalled an article I've read a long time ago, where the author mentioned that the certificate has to be in PEM format and not PFX. After a google search, I found this article on the Citrix Knowledge Center that describes the process of converting a PFX file to PEM for that purpose. All you have to do is to download the openssl binaries and execute the following command in order to convert the file: openssl pkcs12 -in c:\certs\yourcert.pfx -out c:\certs\cag.pem –no...

I recently installed and configured Citrix Command Center on a client to monitor and configure their NetScaler appliances. When I opened the management page with Chrome, I got a message that the server was using a weak DH public key. Since the guys didn't seem to be very helpful with issuing a certificate from their CA, I decided to disable the Diffie-Hellman cipher suites used by Command Center as a workaround. To do that, you have to edit some apache configuration files. The first step is to stop the Command Center service. Then make a backup copy of the following files: 1. CommandCenterInstallDirectory\apache\tomcat\conf\backup\server.xml 2. CommandCenterInstallDirectory\conf\transportProvider.conf Search the server.xml file for "ciphers" to get to the part where the cipher suites are defined and then remove all the DH ciphers.   Set the same ciphers on the <CipherSuites></CipherSuites> part of the transportProvider.conf file. Start the C...

Most of the time I get my certificates from an Active Directory CA but there are times when I want a temporary certificate to test something, like in a lab for example. With the following commands, you can create and export a self signed certificate: To create the certificate at the Personal store of Local Machine use: New-SelfSignedCertificate -DnsName server.lab.local -CertStoreLocation Cert:\localmachine\my   In most cases, like IIS, you should be ready to assign the certificate to your application server by now. In case you want to export the certificate in PFX format (that included the private key), use the following cmdlets: First, you'll need the thumbprint of the certificate from the above command, so save the output to a variable like:     $Certificate = New-SelfSignedCertificate -DnsName server.lab.local -CertStoreLocation Cert:\localmachine\my   Please note that if you have already created the ce...

There are many times when I have to connect to remote servers and get information using WMI but not all of the servers in my list are available all the time... Even though the error from the Get-WMIObject cmdlet is not terminating, I want to handle it. So I use the following code to do it: # Declare the variable to hold the result $servicename # Call the Get-WMIObject cmdlet try     {         $servicename = get - wmiobject win32_service - computername $server - ErrorAction Stop       } catch     {         # If an exception is thrown, set the variable to null         $servicename = $null     }   # Check the value of the variable. if ( - Not ( $servicename - eq $null ) ) {      # Continue processing } else {     # Exception was thrown } ...

On my previous article on  Delegating NetScaler Administration to Active Directory Group , I described how you could allow members of Active Directory groups to login on NetScalers with their AD credentials. Now we are going to do the same thing with NetScaler InSight Center. First of all, we have to setup the external authentication. Login on the InSight Center and navigate to System - Authentication - LDAP and click "Add". Fill in the details of the server like the IP and port and the detailes of the domain. Now that we have configured the authentication, we have to create the groups on the InSight Center. Go to System - User Administration - Groups and add a group with the same name as the group configured on Active Directory. Assign the permissions you want and hit "Create". The only thing left is to enable the authentication. Navigate to System - Authentication and click on "Authentication Configuration". Select "LDAP" as the type a...

I often get the request to delegate the administration of NetScalers to an active directory group, particularly in very large organizations. This is very simple procedure but you should be very careful when giving permissions on such devices since a small mistake may lead to serious problems. Let's get started then... The first thing you have to do is create an LDAP server. This is the server that the authentication requests are going to be directed to. You should add more than one servers as a best practice. I always create an LDAP (and sometimes an LDAPS) vServer with all the AD Domain Controllers and use that one. So, to create the LDAP server, navigate to System - Authentication - LDAP, click "Servers" and then "Add". Fill the friendly name, IP address and port of the server (AD server of LDAP vServer) and the details about the domain and then create the server. Next, you have to create the Authentication policy, click on the "Policy" ta...

I fired up a virtual machine on my lab server today to do some tests around Citrix and I got the well know message that "The trust relationship between this workstation and the primary domain failed." I got this because my server had been offline for a long time and thus hadn't connected to any domain controller. To fix this issue you can use the powershell command  Reset-ComputerMachinePassword   that is available on Windows Server 2012 R2. To my opinion this is the faster way to fix the issue comparing to leaving the domain and joining again or the method using NETDOM. So, you have to do the following: Log in to the server using a local user with administrator  privileges Start powershell with administrator privileges (Run As Administrator) Run the above command (Reset-ComputerMachinePassword) Restart the server (Restart-Computer) That's it!