User manual

Setting the Certificate Checking Mode for Horizon Client
Administrators and sometimes end users can congure whether client connections are rejected if any or
some server certicate checks fail.
Certicate checking occurs for SSL connections between Connection Server and Horizon Client. Certicate
verication includes the following checks:
n
Has the certicate been revoked?
n
Is the certicate intended for a purpose other than verifying the identity of the sender and encrypting
server communications? That is, is it the correct type of certicate?
n
Has the certicate expired, or is it valid only in the future? That is, is the certicate valid according to
the computer clock?
n
Does the common name on the certicate match the host name of the server that sends it? A mismatch
can occur if a load balancer redirects Horizon Client to a server that has a certicate that does not match
the host name entered in Horizon Client. Another reason a mismatch can occur is if you enter an IP
address rather than a host name in the client.
n
Is the certicate signed by an unknown or untrusted certicate authority (CA)? Self-signed certicates
are one type of untrusted CA.
To pass this check, the certicate's chain of trust must be rooted in the device's local certicate store.
N For information about distributing a self-signed root certicate to all Windows client systems in a
domain, see "Add the Root Certicate to Trusted Root Certication Authorities" in the View Installation
document.
When you use Horizon Client to log in to a desktop, if your administrator has allowed it, you can click
 SSL to set the certicate checking mode. You have three choices:
n
Never connect to untrusted servers. If any of the certicate checks fails, the client cannot connect to the
server. An error message lists the checks that failed.
n
Warn before connecting to untrusted servers. If a certicate check fails because the server uses a self-
signed certicate, you can click Continue to ignore the warning. For self-signed certicates, the
certicate name is not required to match the server name you entered in Horizon Client.
You can also receive a warning if the certicate has expired.
n
Do not verify server identity . This seing means that no certicate checking occurs.
If the certicate checking mode is set to Warn, you can still connect to a Connection Server instance that uses
a self-signed certicate.
If an administrator later installs a security certicate from a trusted certicate authority, so that all certicate
checks pass when you connect, this trusted connection is remembered for that specic server. In the future,
if that server ever presents a self-signed certicate again, the connection fails. After a particular server
presents a fully veriable certicate, it must always do so.
I If you previously congured your company's client systems to use a specic cipher via GPO,
such as by conguring SSL Cipher Suite Order group policy seings, you must now use a Horizon Client
group policy security seing included in the View ADM template le. See “Security Seings for Client
GPOs,” on page 44. You can alternatively use the SSLCipherList registry seing on the client. See “Using
the Windows Registry to Congure Horizon Client,” on page 60.
Using VMware Horizon Client for Windows
40 VMware, Inc.