Citrix Virtual Apps and Desktops

Enable TLS on Delivery Controllers

December 11, 2025

Contributed by:

To enable TLS on a delivery controller™, you must:

Obtain, install, and register a server certificate on all Delivery Controllers. For details, see Requesting and installing a certificate.
Configure a port with the TLS certificate. For details, see Requesting and installing a certificate.
Enforce HTTPS traffic by disabling HTTP. For more details, see Enforce HTTPS traffic only.
Optionally, you can change the ports the Controller uses to listen for HTTP and HTTPS traffic. For more details, see Change HTTP or HTTPS ports.

Requesting and installing a certificate

To use TLS, you must install a certificate whose Alternative Name includes the DDC’s FQDN. You must create a suitable certificate. This can be done using a Microsoft Certificate Authority or other internal or external certificate authorities.

Create certificate using Microsoft Certificate Authority

If the Microsoft Certificate Authority is integrated into an Active Directory domain or into the trusted forest the Delivery Controllers are joined to, you can acquire a certificate from the Certificates MMC snap-in Certificate Enrollment wizard. The Microsoft Certificate Authority needs to have a certificate template published suitable for use by web servers. If you are using a Citrix Gateway or a StoreFront™ server on a different domain then you need to export the Root Certification Authority Certificate and import it into the Citrix Gateway and StoreFront.

On the Delivery Controller, open the MMC console and add the Certificates snap-in. When prompted select Computer account.
Expand Personal > Certificates, then use the All Tasks > Request New Certificate context menu command.
Click Next to begin, and Next to confirm that you are acquiring the certificate from Active Directory enrollment.
Select a suitable template such as Web Server Exportable. If the template has been set up to automatically provide the values for Subject you can click Enroll without providing more details.
To provide more details for the certificate template, click the Details arrow button and configure the following:

Subject name: select Common Name and add the FQDN of the Delivery Controller.

Alternative name: select DNS and add the FQDN of the Delivery Controller.
Press OK.
Press Enroll to create an install the certificate

Install existing certificate file

If you have an existing certificate as a file then you can install it:

On the Delivery Controller, open the MMC console and add the Certificates snap-in. When prompted select Computer account.
Expand Personal > Certificates, then use the All Tasks > Import context menu command.
Browse for the certificate file.

Configuring SSL/TLS listener port

If the IIS Windows component is installed on the same server, which is installed as part of Web Studio and Director, you can configure TLS using IIS. For more information, see Enable TLS on Web Studio and Director. Otherwise, to configure the certificate using PowerShell:

To check if there is an existing certificate bound, open an command prompt and run netsh http show sslcert:
```
netsh http show sslcert

```
If there is an existing binding then delete it.
```
netsh http delete sslcert ipport=0.0.0.0:443

```
Replacing 0.0.0.0:443 with a specific IP address and port if there was one specified in the existing binding.
Find the thumbprint of the certificate you installed previously. To view the thumbprint, open Manage computer certificates, browse to the certificate and open it and go to the Details tab.

Alternatively you can use PowerShell. For example the following script looks for a certificate whose common name matches the server’s host name and prints the thumbnail:
```
$HostName = ([System.Net.Dns]::GetHostByName(($env:computerName))).Hostname
$Thumbprint = (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -match ("CN=" + $HostName)}).Thumbprint -join ';'
Write-Host -Object "Certificate Thumbprint for $($HostName): $($Thumbprint)" -Foreground Yellow

```
If the certificate common name does not match the host names then this will fail. If there are multiple certificates for the host name then this returns multiple thumbprints concatenated together and you must choose the appropriate thumbprint.

The following example looks for a certificate by friendly name:
```
$friendlyName = "My certificate name"
$Thumbprint = (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.FriendlyName -eq $friendlyNam}).Thumbprint -join ';'
Write-Host -Object "Certificate Thumbprint for $friendlyName: $($Thumbprint)" -Foreground Yellow

```
If there are multiple certificates with the specified friendly name then this returns multiple thumbprints concatenated together and you must choose the appropriate thumbprint.
To bind the certificate to the port, use the netsh http add sslcert command:
```
netsh http add sslcert ipport=[IP address]:443 certhash=[certificate hash] appid=[application GUID] disablelegacytls=enable

```
- ipport: The IP address and port. Using 0.0.0.0:443 applies this to all IP addresses. You can instead specify a specific IP address.
- certhash: The thumbprint of the certificate you identified in the previous step.
- appid: The GUID of the Citrix Broker Service.
  
  Note:
  
  When renewing a certificate or rebinding, use the specific appid associated with the Broker Service rather than an arbitrary GUID.
  
  To find the correct appid for the Citrix Broker Service:
  1. Open a PowerShell command window as an administrator and run the following command:
    Get-WmiObject -Class Win32_Product | Select-String -Pattern "broker" 
  2. Locate the IdentifyingNumber (GUID) for the Citrix Broker Service in the output (for example, {D333C884-187F-447C-8C67-463F33989C8F}). Use this GUID for the appid parameter.
- disablelegacytls=enable: Disables legacy versions of TLS. This parameter is available on Windows 2022 and higher. Windows 2022 it disables TLS 1.0 and 1.1. On Windows 2025 this is unnecessary as TLS 1.0 and 1.1 are disabled by default.
For example, run the following command to bind the certificate with thumbprint bc96f958848639fd101a793b87915d5f2829b0b6 to port 443 on all IP addresses:
```
netsh http add sslcert ipport=0.0.0.0:443 certhash=bc96f958848639fd101a793b87915d5f2829b0b6 appid={91fe7386-e0c2-471b-a252-1e0a805febac} disablelegacytls=enable

```

Once HTTPS is enabled, you should configure any StoreFront deployments and Netscaler Gateways to use HTTPS instead of HTTP to connect to the delivery controller.

Configure cipher suites

The cipher suite order list must include the TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, or TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 cipher suites (or both); and these cipher suites must precede any TLS_DHE_ cipher suites.

Using the Microsoft Group Policy Editor, browse to Computer Configuration > Administrative Templates > Network > SSL Configuration Settings.
Edit the policy “SSL Cipher Suite Order”. By default, this policy is set to “Not Configured”. Set this policy to Enabled.
Arrange suites in the correct order; remove any cipher suites suites you do not want to use.

Ensure that either TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, or TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 precedes any TLS_DHE_ cipher suites.

On Microsoft Learn, see also Configuring TLS Cipher Suite Order.

Enforce HTTPS traffic only

It is recommended that you configure the XML Service to ignore HTTP traffic.

Run regedit
Open HKLM\Software\Citrix\DesktopServer\
Create a new DWORD value with name XmlServicesEnableNonSsl and set it to 0.
Restart the Broker Service.

There is a corresponding registry DWORD value XmlServicesEnableSsl you can create to ignore HTTPS traffic. Ensure that it is not set to 0.

Change HTTP or HTTPS ports

By default, the XML Service on the Controller listens on port 80 for HTTP traffic and port 443 for HTTPS traffic. Although you can use non-default ports, be aware of the security risks of exposing a Controller to untrusted networks. Deploying a standalone StoreFront server is preferable to changing the defaults.

To change the default HTTP or HTTPS ports used by the Controller, run the following command from Studio:

BrokerService.exe -StoreFrontPort <http-port> -StoreFrontTlsPort <https-port>

where <http-port> is the port number for HTTP traffic and <https-port> is the port number for HTTPS traffic.

Note:

After changing a port, Studio might display a message about license compatibility and upgrading. To resolve the issue, re-register service instances using the following PowerShell cmdlet sequence:

Get-ConfigRegisteredServiceInstance -ServiceType Broker -Binding XML_HTTPS |
Unregister-ConfigRegisteredServiceInstance
Get-BrokerServiceInstance | where Binding -eq "XML_HTTPS" |
Register-ConfigServiceInstance
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Enable TLS on Delivery Controllers

December 11, 2025

Contributed by:

December 11, 2025

Contributed by:

Enable TLS on Delivery Controllers

Requesting and installing a certificate

Create certificate using Microsoft Certificate Authority

Install existing certificate file

Configuring SSL/TLS listener port

Configure cipher suites

Enforce HTTPS traffic only

Change HTTP or HTTPS ports

In this article