User manual

Configuring Certificate Checking for End Users
Administrators can congure the certicate verication mode so that, for example, full verication is always
performed.
Certicate checking occurs for SSL connections between Connection Server and Horizon Client.
Administrators can congure the verication mode to use one of the following strategies:
n
End users are allowed to choose the verication mode. The rest of this list describes the three
verication modes.
n
(No verication) No certicate checks are performed.
n
(Warn) End users are warned if a self-signed certicate is being presented by the server. Users can
choose whether or not to allow this type of connection.
n
(Full security) Full verication is performed and connections that do not pass full verication are
rejected.
For details about the types of verication checks performed, see “Seing the Certicate Checking Mode for
Horizon Client,” on page 26.
You can set the verication mode so that end users cannot change it. Set the "Security Mode" key in
the /Library/Preferences/com.vmware.horizon.plist le on Mac clients to one of the following values:
n
1 implements Never connect to untrusted servers.
n
2 implements Warn before connecting to untrusted servers.
n
3 implements Do not verify server identity certificates.
Configure Advanced TLS/SSL Options
You can select the security protocols and cryptographic algorithms that are used to encrypt communications
between Horizon Client and Horizon servers and between Horizon Client and the agent in the remote
desktop.
These security options are also used to encrypt the USB channel (communication between the USB plugin
and the agent on the remote desktop).
By default, TLSv1.0, TLSv1.1, and TLSv1.2 are enabled. SSL v2.0 and 3.0 are not supported. The default
cipher control string is "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH
+AES:RSA+AES".
N If TLSv1.0 and RC4 are disabled, USB redirection does not work when users are connected to
Windows XP remote desktops. Be aware of the security risk if you choose to make this feature work by
enabling TLSv1.0 and RC4.
If you congure a security protocol for Horizon Client that is not enabled on the Horizon server to which the
client connects, a TLS/SSL error occurs and the connection fails.
I At least one of the protocol versions that you enable in Horizon Client must also be enabled on
the remote desktop. Otherwise, USB devices cannot be redirected to the remote desktop.
For information about conguring the security protocols that are accepted by Connection Server instances,
see the View Security document.
Procedure
1 Select VMware Horizon Client > Preferences from the menu bar, click Security, and click Advanced.
2 To enable or disable a security protocol, select the check box next to the security protocol name.
Using VMware Horizon Client for Mac
14 VMware, Inc.