Trying to log into the Citrix Xenapp Storefront at work today, it looks like they’ve got a new certificate.
This is a pretty easy fix, search for the certificate name and download it, then put it in the right place.
For me, on my Debian machine, it’s /opt/Citrix/ICAClient/keystore/cacerts.
I didn’t have to do anything else, it just worked at that point - start the client again and back to work.