Citrix states in their article: CTX109037

Document ID: CTX109037, Created on: Mar 9, 2006, Updated: Mar 9, 2006

Products: Advanced Access Control 4.2, Citrix Access Gateway 4.2

Summary

This document describes how to configure Access Gateway and Advanced Access Control to communicate securely.

Note: This document was written using Windows Server 2003 dialog references. Windows 2000 Server dialogs will be similar but not exactly the same.

Procedure

1. You must create a Server Authentication Certificate for your Advanced Access Control server. Install this certificate to the Local Computer > Personal > Certificates folder. You must also install the Trusted Root Certificate to the Local Computer > Personal > Trusted Root Certification Authorities folder.

2. Modify the Default Web Site on your farm’s Web servers to use the Server Authentication Certificate that you created in step 1.

a. Open IIS Manager on your Advanced Access Control server(s). Expand the Web Sites node, and highlight the Default Web Site. Right-click Default Web Site and select Properties.

b. Click the Directory Security tab.

c. Toward the bottom of that dialog, under Secure Communications, click the Server Certificate radio button.

d. Click Next to begin the wizard. On the second page you are prompted for the method of locating the certificate. Choose Assign an existing certificate and click Next.

e. Select the certificate that you created in step 1 and click Next.

f. Select the port number you wish to use for SSL on this Web site and click Next.

g. Review your settings and complete the wizard by clicking Finish.

h. (Optional) If you wish to make this Web site ONLY listen on your defined secure port, click the Edit radio button under Secure Communications and select the Require secure channel (SSL) check box.

i. Apply settings and close IIS manager.

3. The next step is to modify the Authentication Server Details. This is done in the Citrix Server Configuration utility. This utility is found under Start > All Programs > Citrix > Access Gateway >Server Configuration.

a. Once you have opened the utility, click the Authentication Server Details page. You need to modify the FQDN on this page to reflect the full FQDN of your Web server.

b. On the bottom of the same dialog, select the Secured with HTTPS check box. This will force your logon agent to communicate securely. Ensure that the port number is correct (only if you changed it above, otherwise it defaults to 443).

4. On the Access Gateway appliance, you must have the Trusted Root Certificate installed, as well as its own Server Certificate before continuing. If you already have the Advanced Access Control server added to the Access Gateway, remove it and restart before continuing.

a. In the Access Gateway Administration Tool, under the Access Gateway Cluster tab, expand the This Gateway window. Click the Advanced Options tab.

b. Change the option under Administer the Access Gateway using: to Advanced Access Control…

c. In the Server running Advanced Access Control field, fill in the FQDN of your Advanced Access Control server. Make sure to select the Secure server communication check box under it and click Submit.

d. Restart the Access Gateway as requested and try to access your Advanced Access Control using the FQDN of your Access Gateway.

Notes:

• If you have Web Interface 4.2 Web Resource(s) configured, you must modify the “Manage Access Method” option on each Web Interface Web site to reflect secure communication (https://) with the Advanced Access Control Web server.

• All clients that connect through this secure configuration must have the secure URL listed under trusted sites in their browser.