As I got issue with one customer today working on XenMobile with CBA (Certificate Based Authentication) and HDX Apps access inside Secure Hub, I just want to share my experience here after.
So the problem was that everything was working except after a while (in fact timeout on Secure Hub, can be reproduced by signing off from Secure Hub).
The user was asked to provide his WorxPIN but it was not working (no validation of the credentials).
We did not really know what was the issue as we follow the Citrix blogs https://www.citrix.com/blogs/2014/01/17/xenmobile-enable-hdx-apps-with-certificate-based-authentication/
After searching for some more information and read the following article https://www.citrix.com/blogs/2015/03/03/mobility-experts-configuring-certificateldap-based-authentication/, I just discovered that in this second article the NetScaler configuration on the XMS is different as the article stands for Certificate + Domain whereas the first blog article just stands for Certificate.
After changing that setting and re-enrolling the device everything works as expected.
Note: Those information are provided based on my own experience.