Just so I remember this next time I do an install. The package to install under modern Ubuntu is the Web Receiver, not the Full Package. Sadly, both show up as icaclient under dpkg, hence the confusion.

And, another note.

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts