Error: "Cannot Process Provisioning File"

Error: "Cannot Process Provisioning File"

book

Article ID: CTX132169

calendar_today

Updated On:

Description

While running the StoreFront Services provisioning file (for example, Receiverconfig.cr) using Citrix Receiver 3.1, issues might be experienced. The following error message might appear:
“Cannot process provisioning file”.
User-added image

Environment

Caution! Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Resolution

Following are the various causes, and the resolutions for the issue:

Caution! Refer to the Disclaimer at the end of this article before using Registry Editor.

Cause 1

If the following error is displayed:
“Error: SSL certificate has an unknown Certificate Authority. Cannot validate SSL certificate.”
User-added image
And if the provisioning file contains Access Gateway settings, as shown in the following screenshot, there is a possibility that the root Certificate Authority (CA) (or intermediate CA) is not installed in the local computer to trust the Access Gateway.
User-added image

Resolution 1

To resolve the preceding issue, import the root CA to trust Access Gateway in the certificate store in Local Computer > Trusted Root Certification Authorities > Certificates folder, as shown in the following sample screen shot.
User-added image

 

Cause 2

If the following error is displayed:
“Error: SSL certificate has an unknown Certificate Authority. Cannot validate SSL certificate.”
User-added image
And if the provisioning file contains the Store URL using HTTPS, as shown in the following screenshot, there is a possibility that users might not have the root CA (or intermediate CA) installed in the local computer to trust the StoreFront Services server.
User-added image

Resolution 2

Import the root CA to trust StoreFront server in the certificate store in the Local Computer > Trusted Root Certification Authorities > Certificates folder, as shown in the following sample screenshot.
User-added image

- If using a self-signed certificate on Storefront for https configuration, then import the root cert into client's trusted root store.

Cause 3

If the following error is displayed:
“Cannot validate SSL certificate.”
User-added image
Then Citrix Receiver is unable to verify the server certificate revocation.

Resolution 3

To resolve the preceding issue, complete the following procedure:

  1. On Internet Explorer browser Options, go to the Advanced tab.

  2. Select Security settings.

  3. Search for Check for server certificate revocation and clear the selected option.
    User-added image

  4. Ensure to close the browser window and start a new one for the changes to take effect.

Cause 4

If the following error message appears:
“Error: Windows Library Internal SSL Error. Cannot validate SSL certificate.”
User-added image

Resolution 4

To allow Citrix Receiver 3.1 or later, add unsecured accounts by running a provisioning file, which requires SSL validation.
Alternatively, Receiver can be manually configured by entering the Server Address of StoreFront. To do this, you need to follow the next procedure to allow unsecured connections to a store.
  1. Navigate to the following locations:

    • For 32-bit - HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\AuthManager

    • For 64-bit - HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\AuthManager

  2. Create a new String value called ConnectionSecurityMode.

  3. Set the value to Any.

  4. Navigate to the following location:

    • For 32-bit - HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\Dazzle

    • For 64-bit - HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\DazzleB

  5. Modify the String value AllowAddStore to A.

    Note: Citrix recommends installing a server certificate on StoreFront Services server to avoid sending in clear text user credentials over the network. 

Issue/Introduction

This article describes how to allow users to successfully run the provisioning file generated by StoreFront Services server.

Additional Information

CTX131857 – Citrix Receiver 3.1 does not Allow you to Add Non-Secure URL.
Citrix Documentation - StoreFront 3.0

Powered by Wolken Software