Citrix ICA file signing

If you deploy APM 11.4.1 HF2 or later, it supports using STA tokens, and thus can be used with ICA signing feature, as ICA file rewrite is not needed in this case. Here is how to do this:

Documentation notes for this feature:

1. Prerequisites:

2. Citrix Web Interface (WI) site working in Gateway Direct Mode and published via Citrix Access Gateway (AGEE)

3. Configuring APM

4. Virtual Server (VS) is configured to provide ICA Proxy functionality either via iApp or as described in here: http://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-citrix-integration-11-3-0.html
5. Additional session variable named "session.citrix.sta_servers" must be added to the policy using the "Variable Assign" agent in Visual Policy Editor
6. The value of "session.citrix.sta_servers" is the same as you would enter on Web Interface:

So the assignment will normally look like this:

session.citrix.sta_servers = return {http://mysta.company.com/scripts/ctxsta.dll}

• If there is more than one STA server, the individual URLs are delimited by a semicolon

If you deploy APM 11.4.1 HF2 or later, it supports using STA tokens, and thus can be used with ICA signing feature, as ICA file rewrite is not needed in this case. Here is how to do this:

Documentation notes for this feature:

1. Prerequisites:

2. Citrix Web Interface (WI) site working in Gateway Direct Mode and published via Citrix Access Gateway (AGEE)

3. Configuring APM

4. Virtual Server (VS) is configured to provide ICA Proxy functionality either via iApp or as described in here: http://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-citrix-integration-11-3-0.html
5. Additional session variable named "session.citrix.sta_servers" must be added to the policy using the "Variable Assign" agent in Visual Policy Editor
6. The value of "session.citrix.sta_servers" is the same as you would enter on Web Interface:

So the assignment will normally look like this:

session.citrix.sta_servers = return {http://mysta.company.com/scripts/ctxsta.dll}

• If there is more than one STA server, the individual URLs are delimited by a semicolon

If you don't use the WI, the APM generates ICA file on its own - it does not rewrite it at all. When using APM to replace WI, it does not leverage/support ICA signing.

there is a RFE for ICA signing, when APM replaces WI (webtop publishing):

Bug 357897 - [Citrix] Implement file signing for ICA files

We are running F5 11.2.1 so could you please let me know how we can do sign the ICA file.

Our Problem is if we add the site as a trusted site then everything works but if we remove from there it stop working, Please suggest