Symptoms or Error
Enrollment and authentication works with LDAP policy however unable to enroll devices using client certification authentication.
Authentication is denied at NetScaler Gateway.??When disabling authentication on NetScaler Gateway, client certificate can be pushed to the device using a device credentials policy from XenMobile server.
The following are the error logs from ns.log file:
SSLLOG SSL_HANDSHAKE_FAILURE 9998 0 : SPCBId 7109 - ClientIP 185.25.64.249 - ClientPort 63163 - VserverServiceIP 10.10.1.125 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "DES-CBC3-SHA SSLv2 Non-Export 168-bit" - CLIENT_AUTHENTICATION_FAILED - SerialNumber "160000000ED1FD5FCA6CECC91400000000000E" - Reason "Intermediate CA or Root CA Certficate Signature Verification Failed" SSLLOG SSL_HANDSHAKE_FAILURE 10001 0 : SPCBId 7109 - ClientIP 185.25.64.249 - ClientPort 63163 - VserverServiceIP 10.10.1.125 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "DES-CBC3-SHA SSLv2 Non-Export 168-bit" - Reason "Handshake failure-Internal Error"
The following are Worx Home logs when trying to enroll a device:
"2015-12-11T16:14:06.534+0000","WorxHome","WARNING ?? ( 3)","Cert:Failed to load AG client cert chain. /data/data/com.zenprise/ag.p12: open failed: ENOENT (No such file or directory)",8381,9938,Worx Home, ??, ??,0
Root CA certificate is using??RSASSA-PSS??signature algorithm, though the client certificate issued were using sha256.
Solution
Renewing the root CA certificate with sha256 signature algorithm fixes the issue.
Problem Cause
Root CA certificate was using the??RSASSA-PSS??signature algorithm, though the client certificate issued were using sha256.
SSL handshake was failing with NetScaler because of the signature algorithm.Supporto Citrix
Traduzione automatica
Questo articolo ??¨ stato tradotto da un sistema di traduzione automatica e non ??¨ stata valutata da persone. Citrix fornisce traduzione automatica per aumentare l'accesso per supportare contenuti; tuttavia, articoli automaticamente tradotte possono possono contenere degli errori. Citrix non ??¨ responsabile di incongruenze, errori o danni derivanti dell'uso di articoli automaticamente tradotte.
Citrix技術支持
自動翻譯
這篇文章被翻譯由一個自動翻譯系統，並沒有受到人們的審查。 Citrix提供自動翻譯，增加獲得支持的內容;但是，自動翻譯的文章可能可以包含錯誤。思傑不負責不一致，錯誤或損壞因使用自動翻譯的文章的結果。
Поддержка Citrix
Tradução automática
Эта статья была переведена автоматической системой перевода и не был рассмотрен людьми. Citrix обеспечивает автоматический перевод с целью расширения доступа для поддержки контента; Однако, автоматически переведенные статьи могут может содержать ошибки. Citrix не несет ответственности за несоответствия, ошибки, или повреждения, возникшие в результате использования автоматически переведенных статей.
시트릭스 지원
자동 번역
이 문서 자동 번역 시스템에 의해 번역 된 사람들에 의해 검토되지 않았다. 시트릭스는 컨텐츠를 지원하기 위해 접근을 높이기 위해 자동 번역을 제공합니다; 그러나, 자동으로 번역 기사 오류를 포함 할 수있다. 시트릭스는 자동으로 번역 된 기사의 사용의 결과로 발생하는 불일치, 오류 또는 손해에 대해 책임을지지 않습니다.