When using StoreFront or Cloud Workspace with Workspace App for HTML5 through an HTTPS URL, applications and desktops cannot be started. One of the following error messages is displayed:

• “Cannot create a secure connection in this browser. Refer to the Citrix Knowledge Center article CTX134123.”
• "Cannot create a secure connection in this browser."
• "Failed to construct 'WebSocket': An insecure WebSocket connection may not be initiated from a page loaded over HTTPS."

There are two possible scenarios of utilizing Workspace App for HTML5 in an environment, and the solution will vary depending on the scenario being used. See below: 

Scenario 1: Internal-Only using Storefront or Cloud Workspace without Netscaler VPX/Cloud Gateway: 

• Enable TLS on the VDA using the following guide:
  • https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/tls.html#configure-tls-on-a-vda-using-the-powershell-script
    
  • This will ensure that the connection path has TLS enabled between the internal client and the VDA.
• Enable TLS on the Delivery Group using the following guide:
  • https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/tls.html#configure-tls-on-delivery-groups

Scenario 2: External using Storefront or Cloud Workspace with Netscaler VPX or Cloud Gateway

• Ensure that the Netscaler VPX/Cloud Gateway are being used. These error messages only occur in this scenario when no Netscaler VPX/Cloud Gateway are found. No modifications are going to be required on the Cloud Gateway Service or a Netscaler VPX for this configuration to work, outside of verifying their usage.
• For Netscaler VPX:  Netscaler VPX will proxy the connections and perform a TLS handshake between the client and itself. SSL is deprecated and TLS should be the primary cipher suite being used.
• For Cloud Gateway Service, to verify it's enabled: 
  1. login to Citrix Cloud
  2.  Select the 3-lined Menu at the top-left of the portal
  3. Navigate to Workspace Configuration
  4. Select the 'Access' tab
  5. Identify the proper Resource Location
  6. Click on the '...' to the right of the Resource Location
  7. Under 'Configure Connectivity' select 'Gateway Service' option

Problem Cause

When Workspace App for HTML5 is hosted on a https site (default and recommended), non SSL/TLS Websocket connections are prohibited by browsers.