Symptoms
When using the Access Gateway Administration Tool to change the "Client Certificate" configuration within Group Properties, the values don't immediately update.
Cause
Removing a setting for a client certificate takes 10 minutes to update. Users are still challenged or prompted for the client certificate.
This is by design.
The "Client Certificate" cache is configured from 10 minutes before that moment. The Access Gateway is operating within the cached values.
Resolution
Restart Access Gateway after a "Client Certificate" change.
More Information
There are only two places on the Citrix Access Gateway where client certificates are configured. The first one is a group setting and the second is a global setting.
