How to MDX Wrap Citrix WorxMail and WorxWeb for iOS

How to MDX Wrap Citrix WorxMail and WorxWeb for iOS

How to MDX Wrap Citrix WorxMail and WorxWeb for iOS

This post has already been read 120546 times!

I have recently build a XenMobile MDM and Citrix AppController 2.9 Pilot and needed to wrap the 2 Worx Apps using MDX technology in order to allow MicroVPN traffic into the internal network.  Below is the procedure you will need to follow in order to wrap the Worx Apps ready for deployment.

Firstly,  Apple will not allow you to sign mobile apps in MDX format on behalf of customers. If you download the mobile apps to their devices you are breaking the Apple EULA. If the customer wishes to proceed to a PoC stage and test on their devices, they must sign up for an Apple Enterprise (or Developer) account, so they can sign the application for themselves.

Luckily (as I am now an Apple Geek due to Andy Mallins from Custard Avenue) I have a developer account and was able to setup and test the wrapping process.

For iOS apps, you need the following basic pre-requisites:
· An iOS mobile app IPA file
· The iOS Distribution Provisioning Profile and Distribution Certificate to sign the app for distribution

For Android apps, you need the following basic pre-requisites:
· An Android mobile app APK file
· Java Development Kit (JDK) 1.7 on your computer
· Android Software Development Kit (SDK) on your computer
· A keystore for signing Android mobile apps

After you download the App Preparation Tool from My Citrix on the Citrix Web site, when you run the tool, the tool prompts you to follow basic steps. For both types of app, use the following guidelines:
· Provide the app name and description about the app
· Provide the supported minimum and maximum operating sysem versions the app
· Provide a list of devices to exclude. The devices in the list cannot run the app
· Save the new Citrix MDX (.mdx) file that the tool creates to your computer. The MDX file is the prepped app that contains Citrix logic and policies

After you complete prepping the app, you then upload the MDX file to AppController. You use the AppController management console to configure application specific details and policy settings that Citrix Receiver enforces. When users log on by using WorxHome, the app appears in the store. Users can then subscribe, download and install the app on their moble device.

So, how to wrap a distributed Apple application.

Login to your account at the following link:
Click iOS Provisioning Portal


If this is the first time you’re logging on to the portal, you will have to request for a certificate. Click Certificates in the left pane.
Click Distribution.
Click Request Certificate.


Follow the instructions on the page to create a new Certificate Signing Request.
Choose Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority.


Enter your email address in the User Email Address field.
Enter your name in the Common Name field.
Select the Saved to disk option.


Click Continue.
Save the Certificate Signing Request to a convenient folder on your computer.
Navigate back to the Provisioning Portal and click Choose File.
Select the Certificate Signing Request file and click Choose.


The certificate will appear with the Status Pending Issuance.
Refresh your page and you will notice that the Status changes to Issued.
Download and install the newly issued certificate as well as the WWDR intermediate certificate.
Click Devices in the left pane and then click Add Devices.


Enter a Device Name, the associated UUID of the device.
Add one or more devices and click Submit.
Your device will appear in the list.
Click App IDs in the left pane and then click New App ID.
Enter a Description for the app.


If you’re going to prep apps that you have not developed such as the Citrix @Work apps, enter a * in the Bundle Identifier (App ID Suffix) field
Click Submit.
Click Provisioning in the left pane.
Click Distribution.
Click New Profile.
Enter a name for the provisioning profile in the Profile Name field.
The associated certificate is automatically selected.
Select the App ID.
Select the Devices you want to run the app on and click Submit.
The provisioning profile will appear with the Status Pending Refresh your page and you will notice that the Status changes to Active.
Download the provisioning profile.

You are now ready to prep applications!

Launch the Citrix App Preparation tool.


Click Browse and select an .ipa file.
Click Next after selecting an .ipa file (Example: WorxMail.ipa).
Enter/edit the application name and description and click Next.
The app name and description are automatically determined from the application installer package. However, you can change the app name on the Verify App Details screen.

Optionally, provide a minimum and maximum OS version for which the app was designed and a comma-separated list of devices you would like to exclude.


Click Next.
Click Browse and select the iOS Distribution Provisioning Profile.
The associated Distribution Certificate will auto-populate in the iOS Distribution Certificate drop-down.
Click Create.
A pop-up appears asking you to provide a name for the resultant MDX file and a location to which you would like to save the file.
Click Create.
A confirmation screen stating that the file has been created successfully appears.
Click Finish.


You now have an app that is ready to upload to your Citrix App Controller for delivery.

*Xcode will need to be at the latest version with Command Line Tools installed.

Once you have uploaded your app to AppController you can configure the specific application boundaries such as open with and network access.

I plan to write a post over the coming days on installing and setting up a XenMobile Pilot as its taken a while to get my head round all the separate components and what they do!


5 thoughts on “How to MDX Wrap Citrix WorxMail and WorxWeb for iOS

  1. Pingback: How to present Citrix XenMobile 8.6 and AppController 2.9 Externally from a single IP Address |

  2. chris

    I have a question for you. I wanting to wrap the worx suite of applications. do i really need to ad the device ID of every ipad or iphone in my organization? This seems very cumbersome, but I am new and trying to figure this out.

    1. Bretty Post author

      No, If you have a Enterprise Development account with Apple you wont need to add your devices into the Apple portal for approval – if you have a personal Dev Account then you will have to add each device individually.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.