Installation

Similarly, if a SAML 2.0 authenticator is congured for View Connection Server, the View Connection Server
computer must have installed the root certicate of the signing CA for the SAML 2.0 server certicate.
Overview of Tasks for Setting Up SSL Certificates
To set up SSL server certicates for View servers, you must perform several high-level tasks.
In a pod of replicated View Connection Server instances, you must perform these tasks on all instances in
the pod.
The procedures for carrying out these tasks are described in the topics that follow this overview.
1 Determine if you need to obtain a new signed SSL certicate from a CA.
If your organization already has a valid SSL server certicate, you can use that certicate to replace the
default SSL server certicate provided with View Connection Server, security server, or View
Composer. To use an existing certicate, you also need the accompanying private key.
Starting Place Action
Your organization provided you with a valid SSL server
certicate.
Go directly to step 2.
You do not have an SSL server certicate. Obtain a signed SSL server certicate from a
CA.
2 Import the SSL certicate into the Windows local computer certicate store on the View server host.
3 For View Connection Server instances and security servers, modify the certicate Friendly name to vdm.
Assign the Friendly name vdm to only one certicate on each View server host.
4 On View Connection Server computers, if the root certicate is not trusted by the Windows Server host,
import the root certicate into the Windows local computer certicate store.
In addition, if the View Connection Server instances do not trust the root certicates of the SSL server
certicates congured for security server, View Composer, and vCenter Server hosts, you also must
import those root certicates. Take these steps for View Connection Server instances only. You do not
have to import the root certicate to View Composer, vCenter Server, or security server hosts.
5 If your server certicate was signed by an intermediate CA, import the intermediate certicates into the
Windows local computer certicate store.
To simplify client conguration, import the entire certicate chain into the Windows local computer
certicate store. If intermediate certicates are missing from the View server, they must be congured
for clients and computers that launch View Administrator.
6 For View Composer instances, take one of these steps:
n
If you import the certicate into the Windows local computer certicate store before you install
View Composer, you can select your certicate during the View Composer installation.
n
If you intend to replace an existing certicate or the default, self-signed certicate with a new
certicate after you install View Composer, run the SviConfig ReplaceCertificate utility to bind
the new certicate to the port used by View Composer.
7 If your CA is not well known, congure clients to trust the root and intermediate certicates.
Also ensure that the computers on which you launch View Administrator trust the root and
intermediate certicates.
8 Determine whether to recongure certicate revocation checking.
View Connection Server performs certicate revocation checking on View servers, View Composer, and
vCenter Server. Most certicates signed by a CA include certicate revocation information. If your CA
does not include this information, you can congure the server not to check certicates for revocation.
Chapter 8 Configuring SSL Certificates for View Servers
VMware, Inc. 81