Upcoming changes in XenCenter

To provide you with greater security, the Citrix Insight Services (CIS) website has extended its multi-factor authentication requirement to applications, like XenCenter, that use the API to upload data. As a result, we are making changes to how XenCenter interacts with CIS.

Review these changes and take the necessary actions to continue to receive support for your Citrix Hypervisor and XenServer deployments.

Recent changes

• In effect from XenCenter 8.2.7: The Health Check feature has been removed from XenCenter. If you are using XenCenter 8.2.6 and earlier, the Health Check feature will soon stop working when multi-factor authentication changes are made to the CIS website API.
• In effect from XenCenter 8.2.7: XenCenter 8.2.7 does not have the option to upload server status reports (SSRs) directly to the CIS website. Instead, you can generate the SSRs with XenCenter and then manually upload your SSRs through the CIS website. If you are using XenCenter 8.2.6 and earlier, the option to upload SSRs to CIS will soon be unavailable when the multi-factor authentication changes are made to the CIS website API.
• In effect from XenCenter 8.2.7: The URL used to check for XenCenter updates has changed to updates.ops.xenserver.com. If your XenCenter is behind a firewall, ensure that it has access to the updates.ops.xenserver.com domain.
• In effect for hotfixes released after Dec 31, 2022: Only XenCenter 8.2.6 and later can check for and download hotfixes. Earlier versions of XenCenter will no longer support this capability.
• In effect for hotfixes released after Dec 31, 2022: You can check for and download hotfixes through XenCenter only if you have set up a client ID for authentication.
• In effect from Nov 23, 2022: XenCenter can no longer be used to apply updates to the end-of-life XenServer 6.x releases. The hotfix files are still on the Citrix support site, but will shortly be withdrawn.

Other XenCenter features are not affected by these changes and will continue to work as before.

What actions do I need to take?

1 - Upgrade to the latest version of XenCenter

Only XenCenter 8.2.6 and later is able to check for and download hotfixes released from January 2023. XenCenter 8.2.5 and earlier is no longer supported.

Ensure that you upgrade to the latest version of XenCenter as soon as possible.

It is available from the Citrix Hypervisor downloads site https://www.citrix.com/downloads/citrix-hypervisor/ in the Citrix Hypervisor 8.2 LTSR section.
 

2 - Set up your client ID in XenCenter

To provide a more secure service for hotfix downloads, XenCenter 8.2.4 introduced a feature that requires authentication with Citrix to automatically download and apply hotfixes.

If you haven't already set this feature up, do so now.

Complete the following steps to set up this capability on your XenCenter instance:

1. Check that your Citrix account has the correct permissions to download Citrix Hypervisor hotfixes:
   1. Log in to https://support.citrix.com with your Citrix account
   2. Go to a Citrix Hypervisor hotfix article, for example https://support.citrix.com/article/CTX472925/
   3. Check that you have permissions to download the attached zip file.
2. If you cannot download the hotfix zip file, contact Citrix Customer Service to ensure that your Citrix account meets the following requirements:
   • You are registered as a contact for your organization.
   • Citrix Customer Service created your Citrix account as a web login associated with the registered contact.
   • Your organization has an active Citrix Success Services agreement.
3. In the XenCenter menu, go to Tools > Options. The Options window opens.
4. In the Updates tab, go to the Client ID section.
5. Click the provided link to go to the page Generate and Download a Client ID in your web browser.
6. Log in with the Citrix account that you ensured had the correct permissions.
7. Click the Download Client ID button. The client ID is provided as a JSON file (xencenter_client_id.json).
8. Return to XenCenter.
9. In the Location field, browse to the location of the JSON file you downloaded (xencenter_client_id.json) and select the file.
10. Click OK.

For more information, see Authenticating your XenCenter to receive updates.

3 - Move your out-of-support XenServer and Citrix Hypervisor deployments to the latest LTSR

Hotfixes for out of support versions of XenServer and Citrix Hypervisor will be removed from the Citrix support site and will no longer be available through XenCenter.

If you are still using an end-of-life version of the product, we strongly recommend that you install Citrix Hypervisor 8.2 CU1 LTSR on your servers instead. Using the latest supported release of Citrix Hypervisor ensures that you continue to receive the latest security and functional fixes for your environment.
 

4 - Set up multi-factor authentication on your Citrix account 

If you have already set up multi-factor authentication on your Citrix account, you do not need to repeat this step. The CIS site uses the MFA options you have already set up.

To access the CIS web site directly, ensure that you have multi-factor authentication set up on your Citrix account. For more information, see Setting Up Multi-Factor Authentication for Citrix Accounts.

To upload a server status report, go directly to the CIS website, instead of uploading through XenCenter.
 

5 - Disable Health Check 

If you are using XenCenter 8.2.6 and earlier, these versions of XenCenter include Health Check or the option to upload SSRs to CIS. These features will stop working when multi-factor authentication changes are made to the CIS web site API.

The disable Health Check in XenCenter:

1. From the Tools menu, click Health Check. The Health Check Overview window opens.
2. In the right-hand panel, click Disable Health Check
3. Click Yes to confirm and then close the Health Check Overview window.

XenCenter 8.2.7 does not include the Health Check or CIS upload features.

6 - Allow access to updates.ops.xenserver.com

XenCenter can periodically check and notify you when a new XenCenter version is available. To provide these update notifications, XenCenter requires internet access. If your XenCenter is behind a firewall, ensure that it has access to the new URL used by XenCenter to check for updates, updates.ops.xenserver.com.