Given the extra information you've provided, it is probably easier for me to start another answer.

It doesn't appear that the dummy "snakeoil" certificate is being presented to the Windows client. The "snakeoil" certificate is generated with a subject of CN=Ubuntu, while the certificate being presented to the Windows box has a subject of CN=Production. So we're looking at a third certificate here.

I can see the same certificate if I connect to your server with OpenSSL's s_client:

$ openssl s_client -connect portal.avendimedia.com:443
...
Certificate chain
 0 s:/CN=Production
   i:/CN=Production
...

What I believe is happening is that you've configured your web server to use the Server Name Indication extension. This extension is designed to let a server present different certificates depending on which host name the client wants to connect to.

This works fine in most modern browsers, but does not work in Internet Explorer on Windows versions prior to Vista. At this point, it seems highly unlikely that Microsoft will update the SSL libraries on Windows XP to support the SNI extension.

If you need your site to work with Internet Explorer on XP, see if you can remove the references to this other SSL host running on the same IP address from your Apache configuration.

To prevent the SSL error 61 when accessing remote sessions:

Make Firefox's certificates accessible to Citrix,

sudo ln -s /usr/share/ca-certificates/mozilla/* /opt/Citrix/ICAClient/keystore/cacerts

^{Source: Citrix help page}