Client Software Requirements

Last published : Sep 03, 2026
NetScaler Gateway supports user connections by using the Citrix Secure Access client. When users log on with the plug-in, it establishes a full VPN tunnel. With the Citrix Secure Access client, users can connect to the network resources to which you allow access.
If endpoint policies are configured on NetScaler Gateway, then NetScaler Gateway downloads and installs the Citrix EPA client on the user device automatically when users log on.

Citrix Secure Access™ client system requirements

Citrix Secure Access client establishes a secure connection from the client machine to the NetScaler Gateway appliance.
The plug-in is distributed as a desktop app for Microsoft Windows, macOS X, and Linux operating systems. After you authenticate to the secure URL of the NetScaler Gateway appliance with your Web browser, the plug-in is downloaded and installed automatically on your machine.
The plug-in is provisioned as a mobile app for Android and iOS devices.
Note:
  • To install the plug-in, admin/root privileges are required on the operating system.
  • The browsers that support the Citrix Secure Access client also support clientless VPN.
Citrix Secure Access client as a desktop app is supported for the following operating systems and Web browsers.
Operating System Supported Browsers
macOS X (10.9 and later) Safari 7.1 or later; Google Chrome Release 30 or later; Mozilla Firefox Release 30 or later
Windows 11 Google Chrome Release 30 or later; Mozilla Firefox Release 24 or later; Edge Chromium
Windows 10 (x86 and x64) Google Chrome Release 30 or later; Mozilla Firefox Release 24 or later; Edge Chromium
Linux; Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS Mozilla Firefox Release 44 and above; Google Chrome 50 and above
Note:
Currently, Citrix Secure Access client and Citrix® EPA client for Ubuntu support only the default GNOME display manager.
If the required dependency packages are missing, the command lists them and the plug-in installation fails. These dependency packages must be manually installed. Administrators can install a missing package by typing the following command using the command line interface.
apt-get install <dependency package>
Citrix Secure Access client as a mobile app is supported for the following operating systems.
VPN App Supported Operating Systems
Android Android 7.0 and later
iOS iOS 12.0 and later
Note:
If you are using the latest Apple OS versions such as macOS 14/iOS 17 and later, then we recommend that you upgrade to Citrix Secure Access client/Citrix SSO version 23.09.1 or later.

Endpoint Analysis requirements

NetScaler Gateway installs the Citrix EPA client on the user device. The Citrix EPA client scans the user device for the endpoint security requirements that you have configured on NetScaler Gateway. The requirements include information, such as the operating system, antivirus, or web browser versions.
When users connect to NetScaler Gateway using the browser for the first time, the portal requests the installation of the Citrix EPA client. On subsequent logon attempts, the Citrix EPA client verifies the upgrade control configuration to confirm whether the Citrix EPA client upgrade is necessary. If it is necessary, the user receives a prompt to download and install the latest Citrix EPA client. The Citrix EPA client for Windows is installed as a Windows 32-bit application. The Citrix EPA client for macOS is installed as a 64-bit application. No special privileges are required to install or use the Citrix EPA client, except when using EPA to access device certificates. For details on how to use EPA for device certificate authentication, see Use device certificates for authentication.
The tooltips on the Admin UI console explain the scans in detail. For details on the EPA libraries, see <https://www.citrix.com/downloads/citrix-secure-access/epa-libraries/epa-libraries-for-netscaler-gateway.html>.
Important:
  • The browsers that support EPA also support clientless VPN.
  • In pre-authentication endpoint analysis, the user cannot log on with the Citrix Secure Access client if the user does not install the Endpoint Analysis plug-in or skips the scan.
  • In post-authentication endpoint analysis, the user can access resources for which a scan is not required by using either clientless access or by using the Citrix Workspace app.
  • For OPSWAT related scans, you must install the binary package epaPackage.exe on the client machine.
The following software is required on the user devices to use the Endpoint Analysis plug-in:
Operating System Supported Browsers
macOS (10.9 and later) Safari 7.1 or later; Google Chrome Release 30 or later; Mozilla Firefox Release 30 or later
Windows 11 Google Chrome Release 30 or later; Mozilla Firefox Release 24 or later; Edge Chromium
Windows 10 Google Chrome Release 30 or later; Mozilla Firefox Release 24 or later; Edge Chromium
Linux; Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS. Mozilla Firefox Release 44 and later; Google Chrome 50 and later
Note:
  • All editions of the operating system variants mentioned previously are supported.
  • Windows 10 and Windows 11 in S modes are not supported.
  • For Windows editions, all service packs and critical updates must be installed.
  • For Mozilla Firefox versions, Endpoint Analysis must be plug-in enabled. The minimum required version is 3.0.