Installation and Setup Guide

n
Is the certicate signed by an unknown or untrusted certicate authority (CA)? Self-signed certicates
are one type of untrusted CA.
To pass this check, the certicate's chain of trust must be rooted in the device's local certicate store.
N For information about distributing a self-signed root certicate to all Windows client systems in a
domain, see "Add the Root Certicate to Trusted Root Certication Authorities" in the View Installation
document.
To set the certicate checking mode, start Horizon Client and select  SSL in the Options menu on
the Horizon Client menu bar. You have three choices:
n
Never connect to untrusted servers. If any of the certicate checks fails, the client cannot connect to the
server. An error message lists the checks that failed.
n
Warn before connecting to untrusted servers. If a certicate check fails because the server uses a self-
signed certicate, you can click Continue to ignore the warning. For self-signed certicates, the
certicate name is not required to match the server name you entered in Horizon Client.
You can also receive a warning if the certicate has expired.
n
Do not verify server identity . This seing means that no certicate checking occurs.
If the certicate checking mode is set to Warn, you can still connect to a server that uses a self-signed
certicate.
If an administrator later installs a security certicate from a trusted certicate authority, so that all certicate
checks pass when you connect, this trusted connection is remembered for that specic server. In the future,
if that server ever presents a self-signed certicate again, the connection fails. After a particular server
presents a fully veriable certicate, it must always do so.
I If you previously congured your company's client systems to use a specic cipher via GPO,
such as by conguring SSL Cipher Suite Order group policy seings, you must now use a Horizon Client
group policy security seing included in the ADMX template le. See “Security Seings for Client GPOs,”
on page 47. You can alternatively use the SSLCipherList registry seing on the client. See “Using the
Windows Registry to Congure Horizon Client,” on page 68.
Configuring Certificate Checking for End Users
You can congure the certicate verication mode so that, for example, full verication is always performed.
Certicate checking occurs for SSL connections between Connection Server and Horizon Client. You can
congure the verication mode to use one of the following strategies:
n
End users are allowed to choose the verication mode. The rest of this list describes the three
verication modes.
n
(No verication) No certicate checks are performed.
n
(Warn) End users are warned if a self-signed certicate is being presented by the server. Users can
choose whether or not to allow this type of connection.
n
(Full security) Full verication is performed and connections that do not pass full verication are
rejected.
For more information about the types of verication checks performed, see “Seing the Certicate Checking
Mode in Horizon Client,” on page 41.
VMware Horizon Client for Windows Installation and Setup Guide
42 VMware, Inc.