Director unable to SSON using DNS record cname with error: "Cookies are not enabled on the browser. Please enable and retry or contact your administrator"

Director unable to SSON using DNS record cname with error: "Cookies are not enabled on the browser. Please enable and retry or contact your administrator"

book

Article ID: CTX216469

calendar_today

Updated On:

Description

This issue doesn't occur if you connect to Director server using Director FQDN.
Director server FQDN: director01.example.com
example: https://director01.example.com/Director

Issue only occurs using CNAME with underscore character
CNAME: r01_director01.example.com

User-added image

Environment

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Resolution

Remove the underscore character from the SAN certificate

 


Problem Cause

CAUSE:
Security patch MS01-055 prevents servers with improper name syntax from setting cookies names. Domains that use cookies must use only alphanumeric characters ("-" or ".") in the domain name and the server name. Internet Explorer blocks cookies from a server if the server name contains other characters, such as an underscore character ("_").

Refer below article from Microsoft for more details:
https://support.microsoft.com/en-us/kb/316112 -PRB: Session Variables Do Not Persist Between Requests After You Install Internet Explorer Security Patch MS01-055

Issue/Introduction

Citrix Director server logon fails with or without two-factor authentication using Windows Authentication method on IIS Error that we get is: "Cookies are not enable on the browser. Please enable and retry or contact your administrator"

Additional Information

https://ma.ttias.be/internet-explorer-wont-allow-cookies-subdomains-underscores/ -Why Internet Explorer Won’t Allow Cookies On (sub)domains With Underscores