Administration

Do not confuse load balancing with SSL o-loading. The preceding requirement applies to any device that is
congured to provide SSL o-loading, including some types of load balancers. However, pure load
balancing does not require copying of certicates between devices.
For information about importing certicates to View servers, see "Import a Signed Server Certicate into a
Windows Certicate Store" in the View Installation document.
Set View Server External URLs to Point Clients to SSL Off-loading Servers
If SSL is o-loaded to an intermediate server and Horizon Client devices use the secure tunnel to connect to
View, you must set the secure tunnel external URL to an address that clients can use to access the
intermediate server.
You congure the external URL seings on the View Connection Server instance or security server that
connects to the intermediate server.
If you deploy security servers, external URLs are required for the security servers but not for the View
Connection Server instances that are paired with the security servers.
If you do not deploy security servers, or if you have a mixed network environment with some security
servers and some external-facing View Connection Server instances, External URLs are required for any
View Connection Server instances that connect to the intermediate server.
N You cannot o-load SSL connections from a PCoIP Secure Gateway (PSG) or Blast Secure Gateway.
The PCoIP external URL and Blast Secure Gateway external URL must allow clients to connect to the
computer that hosts the PSG and Blast Secure Gateway. Do not reset the PCoIP external URL and Blast
external URL to point to the intermediate server unless you plan to require SSL connections between the
intermediate server and the View server.
For information about conguring External URLs, see “Conguring External URLs for PCoIP Secure
Gateway and Tunnel Connections” in the View Installation document.
Allow HTTP Connections From Intermediate Servers
When SSL is o-loaded to an intermediate server, you can congure View Connection Server instances or
security servers to allow HTTP connections from the client-facing, intermediate devices. The intermediate
devices must accept HTTPS for Horizon Client connections.
To allow HTTP connections between View servers and intermediate devices, you must congure the
locked.properties le on each View Connection Server instance and security server on which HTTP
connections are allowed.
Even when HTTP connections between View servers and intermediate devices are allowed, you cannot
disable SSL in View. View servers continue to accept HTTPS connections as well as HTTP connections.
N If your Horizon clients use smart card authentication, the clients must make HTTPS connections
directly to View Connection Server or security server. SSL o-loading is not supported with smart card
authentication.
Procedure
1 Create or edit the locked.properties le in the SSL gateway conguration folder on the View
Connection Server or security server host.
For example: install_directory\VMware\VMware View\Server\sslgateway\conf\locked.properties
2 To congure the View server's protocol, add the serverProtocol property and set it to http.
The value http must be typed in lower case.
View Administration
36 VMware, Inc.