Citrix Workspace Suite

downloadWhy can't I download this file?
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)

Objective

This feature is an important change to the secure communication protocol. Cipher suites with the prefix TLS_RSA_ do not offer forward secrecy and are considered weak. These cipher suites were deprecated in Citrix Receiver version 13.10 with an option for backward compatibility.

In this release, the TLS_RSA_ cipher suites have been removed entirely. Instead, this release supports the advanced TLS_ECDHE_RSA_ cipher suites. If your environment is not configured with the TLS_ECDHE_RSA_ cipher suites, client launches are not supported due to weak ciphers.

This document aims to detail the changes to the cipher suites.

What’s New?

The following advanced cipher suites are supported:

Definition: Fashion Flat sketches, also called Fashion flats or flat drawings, technical flats, or just “flats” in the fashion industry, are a black and white fashion technical drawing that shows a garment as if it were laid flat to display all seams, topstitching, hardware, and any other design details. Fashion design flat sketches. This Collection is the combination of 3 small groups — moto, multi-mesh and laser cut. Moto group is inspired by the details associated with motorcycle trend, such as pintucked panels.

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)

• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)

In earlier releases, the GPO configuration that was available under the below Computer Configuration node which allowed to enable the deprecated cipher suites has been removed now.

Administrative Template > Citrix Component > Citrix Workspace > Network Routing > Deprecated Cipher Suites
The following cipher matrix provides the ciphers supported by the latest SSL SDK:

Expected failure scenarios and edge cases

• TCP

  • OPEN mode: Session launch is not supported when the client is configured for GOV and the VDA for COM. This happens because a common cipher suite is absent.

  • FIPS/NIST(SP800-52) compliance mode: Session launch is not supported when the VDA is configured for COM the client for COM, GOV, or ANY, or the other way around. This happens because a common cipher suite is absent.

• DTLS v1.0 supports the following cipher suites:

• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_EMPTY_RENEGOTIATION_INFO_SCSV

• DTLS v1.2 supports the following cipher suites:
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  • TLS_EMPTY_RENEGOTIATION_INFO_SCSV

• Therefore, session launch is not supported from a client configured for GOV to a VDA configured for COM. Also, fallback to TCP is not supported. When you use DTLS v1.0, session launch is not supported for clients configured for GOV because a common cipher suite is absent.

.

• DTLS does not support FIPS/NIST compliance modes.
• DTLS v1.2 is supported by Windows 10 (1607 and later) and Windows 2016 VDAs. For more information, see Knowledge Center article https://support.citrix.com/article/CTX230010.
• DTLS v1.2 is not supported by Citrix Gateway. This scenario can be tested only with DTLS v1.0. For Citrix Gateway ciphers troubleshooting, see Knowledge Center article https://support.citrix.com/article/CTX235509.

The following matrices provide details of internal and external network connections:

• Matrix for internal network connections (Citrix Gateway scenario)

Citrix Workspace Suite Subscription

• Matrix for external network connections (Citrix Gateway scenario)

Citrix Workspace Enterprise

Note: When NetScaler Gateway is used Rar to zip converter download mac.

Citrix Workspace Suite Download

1. For the EDT to work, NetScaler Gateway must be of version 12.1 or higher since the older versions doesn't support ECDHE cipher suites in DTLS mode.
2. NetScaler Gateway doesn't support DTLS 1.2 so TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 are not supported and NetScaler Gateway must be configured to use TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA for it to work in DTLS 1.0

Citrix For Work

For more information, see the Citrix Workspace app for Windows and Mac documentation.