SSL is enabled on the VDA.
If the full CWA Windows is used, then an ICA connection on port 443 is possible . This demonstrates that the SSL certificate is installed correctly.
WebSockets policies are enabled. By default, this causes the HTML5 Listener on the VDA to listen on Port 8008.

However, if SSL is enabled on the VDA, the HTML5 listener should be on port 443.
Disable any WebSocket policies that are configured.
Be sure to run gpupdate /force on the VDA so that change takes effect.
The HTML5 listener will now listen on port 443.
HTML5 client error - ”Citrix Workspace App cannot create a secure connection in this browser. Please refer to Citrix Knowledge Center article CTX134123.”