Citrix ICA Client How-To for Linux


Note: I changed jobs a couple of years ago, and I no longer have access to a Citrix Server, therefore these instructions are to the best of what I had at the time, and may have changed or require tweaking since the last time I executed them.

Fortunately for us Linux users, Citrix provides binaries for connecting to Citrix servers from Linux boxen. Unfortunately, they have made the attempt to oversimplify the installation of their binaries by providing an installation script. The installation script is flawed in that it assumes you want to use Netscape as your browser. And even then it doesn’t seem to install ready-to-use. So for those of us that want to use it with a different browser (and/or Netscape for that matter), we are relegated to hunting google and/or searching for hidden documentation on how to manually install the client. So to Citrix, I say "A for effort" and "F" for not realizing that us linux techies also like to have detailed instructions on how to manually install when the automated install doesn’t suit our needs. And that brings us to the purpose of this page.

Obtaining the Citrix ICA Client

You need to obtain the Citrix ICA Client package. Citrix offers an RPM, but for the purposes of this page, I’m recommending the tarball. Thus, these instructions will be based off of the tarball download.

First, obtain the Citrix ICA Client tarball by going to and selecting "Downloads". Or if you specifically want the current Linux x86 tarball, go to From this point on in the documentation, the tarball will be assumed to be the x86 version, so substitute accordingly if you have to.

Unpacking Citrix ICA Client

Once you've obtained the tarball, you need to unpack it. Pick a temporary location to unpack this tarball. For this page, we’ll use /tmp/citrix/. So create the temporary directory, move the tarball to that directory and change into that directory:

mkdir /tmp/citrix/

mv linuxx86.tar.gz /tmp/citrix/

cd /tmp/citrix/

Now unpack the tarball:

gzip –decompress linuxx86.tar.gz

tar xf linuxx86.tar

Now to run the installation command you must be logged in as the super user (root). So change to root (using su, or however).

Execute the installation script, and follow the instructions as prompted:


Using the default installation directory is highly recommended. If you choose not to, you’ll have to read the install.txt to figure out what environment variables need to be set to get the Citrix ICA Client to work. The rest of this page will assume that the Citrix ICA Client was installed to its default directory. If the default was chosen, the binaries are now installed in /usr/lib/ICAClient/.

Note: I reccomend answering "No" to the installer when it asks if you'd like to integrate Citrix automatically since this How-To handles all of the setup needed.

Configuring Your Browser

These directions should work for Firefox, Mozilla, Netscape, and any other Linux Mozilla-based browser. The first step is to find the plugins directory for the browser you wish to configure. The plugins directory is typically found as a subdirectory of the installation directory for your browser. If you are unsure of the location of your plugins directory, you can try the following command to attempt to locate the plugins directory:

find / -name plugins | grep -i "netscape\|firefox\|mozilla"

We’ll assume that we are configuring Firefox, and that Firefox was installed to /opt/firefox. Again the following will have to be done as the superuser (root). Change into the plugins directory of your browser:

cd /opt/firefox/plugins/

Next, create a symlink (aka softlink) to the Citrix ICA Client library:

ln –s /usr/lib/ICAClient/

If the Citrix install script was able to find Netscape, it probably already did this step for you.

Connecting to Citrix and Using the Citrix ICA Client

Close all running instances of the browser you configured (just to be safe). Open a new instance of the browser. Type the URL of and connect to your Citrix Server (as though installation were complete). Login to the Citrix server with your user id and password. Once logged in, you should get the mini-desktop with all of your applications. The first time you click on an application, your browser is likely going to popup a dialog box giving you the choice to open the file or save the file. Choose the option to open the file. Where it asks for the application to use on this type of file, type in the path to the wfica application:


If given the choice, tell the browser to use this application for all future downloads of this file type.

Congratulations! You have installed and configured the Citrix ICA Client.

Reader Comments:

12/02/2015 8:59 AM - Citra wrote:
Hi AJ,until now there's no document or alike out there dicnribesg what you need to do.Here a few tips:You need to use Task Scripts in AppDNA which react on green results for virtualization.Those task scripts then execute a script (whatever language you like) which trigger the App-V sequencer which then creates the APP-V package.Take a look at the AppDNA documentation. This should explain a bit how to create a task script.Hope that helps a bit!Regards,David

10/14/2015 3:07 PM - Sasuke wrote:
Thank you Paul.I have read this articles araledy. I cannot even create the colors from scratch, I do not even talk about exporting them. The amount of crashes I have got in a week probably exceed the amount I've got since 2009 I first moved to Inventor. It just enough to touch appearances. I mean literally Did you try Origin Plane Display while creating a part in assembly?Did you see the new location of Open Drawing?I cannot say every new version is coming smooth. But this one is some sort of exception. Hope they will fix it soon Regards, Orest

05/14/2015 4:34 PM - CitrixFails wrote:
Way too much work to get this to work on RHEL unbelievably. Better to just give the user a Windows laptop with this stuff installed. You guys really need to get this nailed down better for both Windows and Linux.

04/20/2015 3:35 AM - long nguyen wrote:
thank you so much for your tutorial.

12/28/2014 3:39 AM - Cristian wrote:
No. No because pulhisbed applications/desktop virtualisation were designed to deliver standard applications that don't run outside of a windows environment. Now, you can argue that if you're only sending screen updates via a remote protocol (such as ICA) then that is less data than sending the content and I'd nod in agreement. But what happens when content is thought of differently. Why send an image of some text, when I can just send the text? Why encapsulate an image when the raw image file is smaller?An issue with many client/server apps is that the data sent to the end point can be large: here sending the view of the data is more efficient than sending the all the data for sure. In addition, being able to control and judge the bandwidth use is useful for scaling network connections between sites: remote protocols take the edge off the unpredictability that some data transactions can bring. Yet in a mobile environment its not just about the data in transit what about data at rest? Having and being able to manipulate/enter the data is key. While it is inconvenient for home users to have their bandwidth capped, it can be job-stopping, deal losing for business users trying to manipulate transactions or data when they are out of range/abroad/beyond their data cap. An advantage of fondleslabs and smartphones is that, to an extent, your application and data is local to you: and you can sync data when you get in range. Application developers are (to an extent) more savvy in limiting the data presented to the end device straight client-server has been replaced by multi-tiered architectures. And that application is designed to use your device. Yes there are issues with protecting that data on the device. Yes there are issues converting an application from a desktop based environment to a native app. Published Apps and desktops can be useful but the requirement to be on-line will impact just too many people in too many situations. I think Citrix have an interesting angle with the SDK allowing you to utilise components of the end device. I think Ericom's HTML5 client and their initiative to engage developers to fast track SaaS options will be closely monitored. A component but I don't think it will be a significant (in terms of sales) component.

12/01/2013 12:20 AM - Sunil wrote:
One question: I am able to install citrix receiver on fedora 18. But from mozilla ... citrix application are getting timed out. Error message is saying to have configuration change.... what config changes need here?

09/26/2013 4:25 PM - cooper wrote:
Was most helpful for me, many thanks! Installed on Centos 6.4 64-bit the 64-bit rpm package using yum localinstall - took care of various GTK dependencies. Well, >>ldd wfica still showed missing ALSA library, thus >>yum install was needed in addition. I have put the symbolic link to into lib64 pluggin directory of mozilla Firefox. Last problem was getting PCA-3G5 certificate and putting it into keystore directory if ICA client. Finally I associated .ica with wfica and launching from corporate website is afterwards working like a charm!

05/02/2013 3:17 PM - Ali wrote:
We have installed citrix on linux RHEL6. I was able to see the Citrix desktop and all the apps in it but when i click on the icons the citrix receiver just says connecting and then says "unable to connect to the server" Please help me.

04/02/2013 9:26 PM - Vinicius wrote:
Thanks! Worked like a charm!

10/09/2012 4:14 AM - Steph wrote:
Wow. I didn't know about WinFLP at all.I can understand why Microsoft wants to keep this ousbcre. If word got out that WinFLP is a compatible replacement for Windows XP that runs on lesser hardware, a lot of people would be interested in getting it for their older systems!I know at least two people that are financialns on lesser hardware, a lot of people would be interested in getting it for their older systems!I know at least two people that are financially poor, but still like to use computers, and have trouble trying to keep up with the latest versions of Windows because they have to use very old hardware as they can't afford new.The forced hardware upgrades required to keep up with Windows operating systems have been a gravy train for the hardware industry. If word gets out about WinFLP, and consumers start demanding it, this gravy train could come to an end .

08/14/2012 7:05 AM - Jeff wrote:
No joy. Trying from overseas to talk to a server state-side, using vpn, keep getting 'Operation not permitted. Verify your connection settings and try again.' However, this works fine in VirtualBox running MS Windows. Not sure how to debug, hints would be appreciated.

05/31/2012 1:18 AM - y164 wrote:
This also worked on my gentoo box! Thank you very much. I installed our server certificate under the cacerts folder which was under my ICAClient parent folder which I installed under my home directory Thanks again

05/29/2012 1:59 PM - Duder wrote:
For CentOS 6 users out there, download the root authority certificate from the respective site. Log in as root and copy the CRT file to /opt/Citrix/ICAClient/keystore/cacerts This worked for me.

05/07/2012 3:21 PM - Stefan wrote:
Thanks for the info. I no longer have to use virtualbox for access. Note that the current version of Citrix client installs under /opt/Citrix/ rather than /usr/lib/.

03/13/2012 8:26 PM - Greg wrote:
I have to tell you - this ROCKS! I've been trying to keep from using VirtualBox (which I love for some things) and WindowsXP (which I can't stand) to connect for probably over a year now. This is the first article I've found that really spells it all out. Admittedly, I didn't search very hard until today, but still what I found didn't get the job done. Thank you so much for this!

12/18/2011 4:30 AM - Richard Cain wrote:
Wow, so simple and straightforward! I've been messing around for months trying to get this sorted, installing the .deb package off the website and getting nowhere. This page is definitely going in my "favourites" folder right now! Thank you so much.

12/13/2011 4:01 PM - RS wrote:
Thanks for this. It made my install much easier--no, possible. As of this date (Dec 13, 2011) Citrix has a 64-bit ICA client for Linux in source, RPM, and DEB form. I'm running Linux Mint Debian Edition 64-bit, so I downloaded the DEB file onto my machine and tried to install it with: $ sudo dpkg -i icaclient_12.0.0_amd64.deb The install failed becuase the client needed a bunch of 32-bit libraries! What??? I had already installed OpenMotif from the repository, so I decided to try installing FFMpeg, which Citrix uses: $ sudo aptitude install ffmpeg. Aptitude found conficts with existing packages and proposed to uninstall a bunch of stuff, which I declined. Its second proposal was to not install ffmpeg at all, but rather to install all the 32-bit libraries that the ICA client wanted. That I happily accepted. When aptitude finished I re-ran the ICA client install, which completed without complaint. Did the Firefox setup per your instructions...and life is good! (Thank you, Aptitude!) Citrix in Firefox now works.

09/06/2011 4:25 AM - r5x wrote:
great thankyou! this page finally got it working for me under arch linux - using firefox 6. The trick for me was to make the symlink from mozilla plugins to the file. After that, works like a charm. Thanks!

08/25/2011 9:25 AM - Shakira wrote:

04/12/2011 9:43 AM - JT wrote:
You might have to import the server certificates to /usr/lib/ICAClient/keystore/cacerts. Otherwise, an SSL error will pop up and you can't connect to the service.

03/21/2011 3:36 AM - cosmin wrote:
i installed ICA client, and it seems ok up to the point where i get this message instead of the application: ICA File section WFCLient contains duplicate keys named (SSLProxyHost). i opened the file but there is no SSLProxyHost line at all ,

03/05/2011 7:14 PM - Arun Sharma wrote:
Thanks , for sharing

02/23/2011 9:19 PM - asterix wrote:
Perfect guide. Still valid. No issues. Running debian 6.0, ica client 9 and iceweasel.

12/24/2010 6:25 PM - Esekla wrote:
For any of you concerned about security and having unaudited binaries on your system, note that it is not necessary to be root to install the Citrix client. You can install in usermode and still get access, you just won't get usb redirection.

04/23/2010 4:55 PM - Everhard Faas wrote:
Fedora 9 ... 12, various Ubuntu releases. 32 and 64-bit. ICA 10 and 11. Each time after about 30 minutes a connection failure appear. Only under Linux. Same system booted with windows will never break...

04/23/2010 4:52 PM - Everhard Faas wrote:
Works fine, till about 30 minutes. Not only my own installations the last years i've tried, but also my collega's got the same problem. Only under Linux, Windows as client for ICA is no problem. Does anybody know whats happening here?

04/15/2010 7:51 PM - Kurt wrote:
What the heck I copy all the of certificates from /usr/share/ca-certificates/mozilla to /usr/lib/ICAClient/keystore/cacerts/ to get rid of the "SSL error 61". (Using Ubuntu 9.10 64bit)

02/15/2010 11:34 AM - wds wrote:
There is one additional step required to get the ICA client to work on fedora 12. The LANG environment variable needs to match one of he directories in the nls directory under the path where the ICA client has been installed. If is being used to start the client one can add the LANG env setting there, e.g. for bash: export LANG=en

01/29/2010 9:08 AM - Cor wrote:
Without changing anything on my machine since the last time, suddenly the problems are solved. I will never hear it from the system administrators, but they must have changed something on their side.. So if ever someone comes across the black boxes, make sure the administrators have done all they can do.

01/13/2010 5:53 AM - Martijn Lievaart wrote:
Using FC12: - I installed openmotif by YUM - Used the RPM from Citrix instead of tarball - Shortcut needed modifying, client did not work with LANG=*.utf8, does work with LANG=en_US

12/28/2009 10:05 PM - Deepak Hemachandran wrote:
Thanks!! I use Ubuntu 9.10 & this is a perfect guide!

12/17/2009 3:37 PM - Babu Rajendran wrote:
I had to copy few more certificates from firefox folder to the mentioned location.. after that it worked like charm.. Thanks

12/11/2009 2:58 PM - Cpt wrote:
Stokey: you will have to find that certificate (I did it by asking somebody with another distribution than mine (I have Slackware) and he had that certificate in his Firefox browser directory. Copy that in the ICAClient/keystore/cacerts directory and you should be okay. This should work in both Windows and *nix environments.

12/10/2009 1:05 PM - Stokey wrote:
When I log in I get a client error message "You have chosen not to trust "/C=US/ST=/L=/O=Equifax/OU=Equifax Secure Certificate Authority/CN=", the issuer of the server's security certificate (SSL error 61)" How do I enable this??

12/10/2009 8:00 AM - Kees wrote:
I fount this page because I had problems with starting up ICA under Fedora12. Some usefull tips found here. But the most important problem I solved with some other help: I needed to get rid of the font cjkuni, done this by renaming /usr/share/fonts/cjkuni-uming/fonts.dir and fonts.scale to fonts.dir.old and fonts.scale.old. After that my ICA client works :-)

12/07/2009 8:53 AM - Cpt wrote:
Wim, could you clarify on your findings? When I check the firefox error console I see that the appserver is trying to get my client to set width etc. but no mention of refused cookies. I do get past logon in Firefox, it is just when I start an application that it goes wrong. I see the splash-screen of the ICA client, but after that (so when the app. is negotiating the capabilities and beyond) it all turns black.

12/05/2009 6:36 PM - WimBakker wrote:
The ica client does not work with firefox, it works with konqueror , but only login works , it's not possible to run any applications in konqueror from within the ica desktop. Firefox seems unable to accept the cookies the ica server sends so the ica server keeps telling that the browser should accept cookies for a connection to be made,

12/01/2009 3:19 PM - Cor wrote:
Additionally: it has worked in the past, I definitively haven't removed anything on my end and upgrading to 11.0 doesn't help either (nor downgrading to 10.whateveritwas.

12/01/2009 2:57 PM - Cor wrote:
All certificates are in place, but once I start an application on the server all I see is a nice black box in which the application apparently is running. What am I missing? I have installed the latest and greatest Citrix client. Running Slackware 12.2 within plain vanilla KDE 3.5.10 and kernel

11/25/2009 11:31 AM - Gerald wrote:
Did the same as Frank for the certificates and it worked! I am also on Ubuntu 9.10. Thanks!

11/24/2009 2:56 AM - Frank wrote:
Thanks a lot! It worked perfectly. I had to copy a couple of certificates from /usr/share/ca-certificates/mozilla to /usr/lib/ICAClient/keystore/cacerts/ to get rid of the "SSL error 61". (Using Ubuntu 9.10)

10/24/2009 8:39 PM - toomanystring wrote:
Very Nice. Worked perfectly on Oracle Enterprise linux

06/16/2009 2:40 PM - the maniac wrote:
the plugin installed in FF no prob. but starting the citrix server gives a "the terminal server is not supported in this browser". If I look at the terminal server dropdown, ica is grayed out. I'm sure it's a simple fix, but I sure can't figure it out! Running jaunty DT w/FF3, citrix 11. All freshly d/l-ed and installed

06/10/2009 8:13 AM - Bernardo wrote:
Everything seems to work fine, except for the keyboard. I can't make any key echo at the screen when I hit it. What could possibly be wrong ?

05/27/2009 10:29 AM - Peeta wrote:
Jojomi My expericen with citrix is kinna lite but it appears that it all depands how the CITRIX server was setup on you company's site. Some people report having no problem at all other cant get it to run for the hell of it. I have the exact same issue as you do. It appears the browser downloads a file called "AccessGatewayClientLaunch.vcagc" but the npica does not know what to do with it. I tried to reasearch the mistyrious VCAGC file but found no info what so ever.

04/26/2009 12:19 PM - Hardeep Singh wrote:
doesnt work for me. says "this browser is not supported". am trying with firefox

03/14/2009 7:29 PM - Ian wrote:
Tried this - still get " The Web site is unable to detect the appropriate client software on your computer to allow you to access your published resources. Click here to obtain the client software "

02/13/2009 5:40 AM - sergio (CL - STGO) wrote:
we don't have problem with citrix client, we have problem with printer atached a client, we can local print, but not throow citrix. We read about spool, but not found information about this problem. We see file printcap, etc, etc, etc, but don't have any idea about this problem. any help will be thanks. Sorry for my english. ;)

12/23/2008 4:12 AM - Eric wrote:
Thank for the help with the certificate. Been battling with this for a while and now I can work

12/18/2008 8:23 PM - eric wrote:
whats the most minimal linux install required? assuming: some form of a gui desktop citrix login remote file shares internet browser network & printer support shortcut for a sudo terminal java based app support got my ubuntu ibex down to 2.25g, can i get rid of ubuntu desktop, what else will help a network thin client?

12/14/2008 12:48 PM - Frrrnk wrote:
Thanks a lot!! Works perfect. Nearly went back to WinXP. Running the setupwfc script did the trick.

11/19/2008 12:32 PM - LinuxN00b wrote:
Awesome, thanks. Now if only I could figure out how to make remote windows drive mappings (via group policy) work under Linux :(

11/17/2008 11:33 PM - Eman wrote:
I'm using CentOS 5.2 and I have followed the instructions in this guide. However, when i click an application in the mini-desktop I get a window that says: Network or dial-up problems are preventing communication with the server. Could someone shed some light on this. Thanks...

11/05/2008 8:59 PM - Chris wrote:
Thanks - used the same tarball as Scott - worked straight away - Ubuntu 8.04 - sems to be working fine under Firefox and Epiphany.

10/31/2008 8:55 AM - Scott wrote:
Awesome. Worked like a charm, thank you! Only difference is the link to the tarball you posted doesn't work. I went to their Downloads section and downloaded the file en.linuxx86.tar.gz. The guide worked perfectly.

10/29/2008 4:49 PM - Hanzi Muller wrote:
Works just as advertised. Pretty old version of Linux (Ubuntu 6.06) and Firefox 2.0.017, but it works perfectly. Thanks.

10/16/2008 6:03 PM - coryem wrote:
Firstly, thanks for useful guide. I too was faced with the ssl error 61 message but by simply exporting the certificate mentioned in the error window and placed it into the directory '/usr/lib/ICAClient/keystore/cacerts/' as mentioned by G?rald. I also renamed the extension of the certificate file to .crt and bob's you uncle. I would like to point out that wfica had failed for me too but I decided to ignore that error and try the export of the certificate first before reinstalling the client. Lucky I did :O)

10/13/2008 11:03 AM - G?rald wrote:
I followed the directions, worked up to the final stage. i.e. I can logon my company's site, when I click on the my application I get the "SSL error 61" mentioning not having trusted certificates. My company has posted a certificate file on its site; I downloaded the certificate and placed it in the /usr/lib/ICAClient/keystore/cacerts/ directory, I changed its ".cer" extension to ".crt" but to no avail, after many hours of trying I am giving up for now. Anyone has a suggestion?

10/09/2008 8:58 AM - ana wrote:
It worked! Thanks

09/13/2008 4:14 PM - Bryan Allred wrote:
FYI If you have any problems concerning an SSL error 61 mentioning not having trusted certificates (CA Root certificates) don't worry. You can either export it from Firefox, or download the .cer file from a public website and place it in the /usr/lib/ICAClient/keystore/cacerts/ directory.

09/01/2008 8:28 AM - nitro wrote:
Thanks for the info. Works fine for me, did not have to supply the path to the wfica application.

08/04/2008 3:41 PM - biouser wrote:
didn't work for me. I have some horrendous issues with fonts, then with some fixes still: bio@bio-bushido:~$ sudo /usr/lib/ICAClient/wfica Error: 12 (E_MISSING_INI_ENTRY) Please refer to the documentation. Warning: Missing charsets in String to FontSet conversion Warning: Unable to load any usable fontset Error: Aborting: no fontset found

08/01/2008 10:41 AM - Jojomi-----gmail wrote:
Hello! fyi I already found the /home/user/.mozilla/plugins# ln -s /usr/lib/ICAClient/ ln: creating symbolic link `./': File exists Anyway... I start the /usr/lib/ICAClient/wfica and a windows pops up saying "error in configuration file. Section "ApplicationServers" must contain an entry ""." I tried starting off an empty appsrv.ini file and with another one with appservers but did not have luck. Basically I think that starting off a clean installation I should be prompted to configure my client. Had no luck with wine either, regsvr32 present but not as the installer expects I suppose. GG

Post a Comment:

Your Name:
Your Comment:

Copyright 2004-2016 Wade Wassenberg
Last Modified: Tuesday June 10, 2014. 
If you have questions, comments, or if you find any part of this document to be inaccurate or incorrect, please submit your feedback to