User manual

Setting the Certificate Checking Mode for Horizon Client
Administrators and sometimes end users can congure whether client connections are rejected if any or
some server certicate checks fail.
Certicate checking occurs for SSL connections between Connection Server and Horizon Client. Certicate
verication includes the following checks:
n
Is the certicate intended for a purpose other than verifying the identity of the sender and encrypting
server communications? That is, is it the correct type of certicate?
n
Has the certicate expired, or is it valid only in the future? That is, is the certicate valid according to
the computer clock?
n
Does the common name on the certicate match the host name of the server that sends it? A mismatch
can occur if a load balancer redirects Horizon Client to a server that has a certicate that does not match
the host name entered in Horizon Client. Another reason a mismatch can occur is if you enter an IP
address rather than a host name in the client.
n
Is the certicate signed by an unknown or untrusted certicate authority (CA)? Self-signed certicates
are one type of untrusted CA.
To pass this check, the certicate's chain of trust must be rooted in the device's local certicate store.
I For information about distributing a self-signed root certicate that users can install on their
Android devices, as well as instructions for installing a certicate on an Android device, see the
documentation on the Google Web site, such as the Android 3.0 User's Guide.
To set the security mode, open . If you are connected to a remote desktop or application in full-
screen mode, tap the Horizon Client Tools radial menu icon and tap the gear icon. If you are not using full-
screen mode,  is in the menu in the upper right corner of the Horizon Client toolbar. If you are not
connected to a remote desktop or application, tap the gear icon in the upper right corner of the
Horizon Client screen. In , tap Security options and tap Security mode. You have three choices:
n
Never connect to untrusted servers. If any of the certicate checks fails, the client cannot connect to the
server. An error message lists the checks that failed.
n
Warn before connecting to untrusted servers. If a certicate check fails because the server uses a self-
signed certicate, you can click Continue to ignore the warning. For self-signed certicates, the
certicate name is not required to match the server name you entered in Horizon Client.
n
Do not verify server identity . This seing means that no certicate checking occurs.
If the certicate checking mode is set to Warn, you can still connect to a Connection Server instance that uses
a self-signed certicate.
If an administrator later installs a security certicate from a trusted certicate authority, so that all certicate
checks pass when you connect, this trusted connection is remembered for that specic server. In the future,
if that server ever presents a self-signed certicate again, the connection fails. After a particular server
presents a fully veriable certicate, it must always do so.
Share Access to Local Storage
You can congure Horizon Client to share local storage with a remote desktop or application. This feature is
called client drive redirection.
In a Windows remote desktop or remote application, local storage appears in the Devices and drives section
in the This PC folder, or in the Other section in the Computer folder. The folders and storage devices that
you select for sharing use the naming format name on HorizonClient.
Using VMware Horizon Client for Android
34 VMware, Inc.