What’s new
What’s new in 2603
This release of Citrix Provisioning includes the enhancements described in the following sections. It includes several fixes for issues seen in past releases, and issues that we have identified.
New server certificate requirements
A server certificate for the provisioning server is now required in all configurations. Additionally, each server certificate must meet additional requirements. To help with this, the Configuration Wizard now includes a feature to generate a self-signed certificate that meets these requirements.
For more information, see:
- Deploy certificates
- Use a CA-signed certificate
- Use a self-signed certificate
- Use Configuration Wizard to deploy certificate
Support for the New Microsoft SecureBoot CA Certificates
As documented by Microsoft at Windows Secure Boot certificate expiration and CA updates - Microsoft Support, the current certificates used for validating binaries when using Secure Boot are expiring in 2026 and have been replaced by new CA certificates which will be used in the future to validate that binaries are properly signed. This release of Citrix Provisioning includes support for secure boot when these new certificates are being used. See Windows Secure Boot certificate expiration and CA updates for details on how you can prepare for supporting secure boot once this has happened.
It is vital that you start the process of upgrading the hypervisor and existing VMs as well as upgrading to a version of Citrix Provisioning that supports the new certificates now to avoid outages starting in June 2026.
For more information, see Windows Secure Boot certificate expiration and CA updates.
New ports for internal communication
In addition to using UDP ports 6890-6909 for internal communications between provisioning servers, TCP ports 6890-6909 are now also used as Citrix Provisioning transitions to an improved internal communications protocol which will facilitate future enhancements. These ports must be allowed through the firewall. The provisioning server installer will adjust the firewall rules for these new ports if you select to automatically open the firewall ports. For more information, see UDP and TCP ports.
Configuration Wizard help clarifies database authentication modes
The Configuration Wizard command-line help documents permitted values for database authentication mode parameters, including supported Active Directory and Entra ID options for Azure environments.
Server installer opens required TCP ports
The server installer opens TCP ports 6890-6909 in Windows Firewall to support server-to-server communication.
UEFI Secure Boot supports new Microsoft signing certificate
Target devices that use UEFI Secure Boot boot images signed with the new Windows UEFI CA 2023 certificate and continue to support images signed with the previous Microsoft certificate.
Configuration Wizard enforces SSL certificate validity
The Configuration Wizard requires an SSL server certificate and validates that the selected certificate meets requirements. It rejects certificates that have expired or are not yet valid and provides clearer on-screen guidance about certificate requirements.
PvsRpc improves server-to-server communication resilience
Server-to-server communication uses the new PvsRpc mechanism. Authentication between PVS servers tolerates clock differences of up to about five minutes, and the system reports communication failures as localized “Inter Process Communication Error” messages.
Log Collector captures additional target device messages
The Log Collector captures additional target device log messages and provides more diagnostic information for troubleshooting target device issues.
Configuration Wizard strengthens SSL setup checks
When you configure SSL settings in the Configuration Wizard, it warns you when a selected certificate is near expiration and prevents you from selecting a certificate that lacks an exportable private key. It also labels the SSL port field as “SOAP SSL port” for clarity.
Provisioning Server monitors SOAP SSL certificate status
The Provisioning Server automatically monitors the SOAP server’s SSL certificate and writes Windows Event Log warnings when the certificate is near expiration, has expired, or cannot be found. This behavior helps administrators renew certificates before service disruptions occur.
Configuration Wizard improves SPN failure guidance
When the Configuration Wizard cannot create a service principal name (SPN), it displays a clearer warning that explains the impact and next steps. The warning indicates that configuration can continue, but Kerberos-authenticated connections to the provisioning server are affected, and no connections are possible if NTLM is disabled.
Configuration Wizard aligns PvsRpc base port settings
The Configuration Wizard configures the base port for the PvsRpc communication service and keeps it aligned with the base port that you specify for server-to-server communication.