User manual

n
Is the certificate signed by an unknown or untrusted certificate authority (CA)? Self-signed certificates
are one type of untrusted CA.
To pass this check, the certificate's chain of trust must be rooted in the device's local certificate store.
Note For information about distributing a self-signed root certificate and installing it on Mac client
systems, see the Advanced Server Administration document for the Mac Server that you are using, which
is available from the Apple Web site.
In addition to presenting a server certificate, the server also sends a certificate thumbprint to
Horizon Client. The thumbprint is a hash of the certificate public key and is used as an abbreviation of the
public key. If the server does not send a thumbprint, you see a warning that the connection is untrusted.
To set the certificate checking mode, start Horizon Client and select VMware Horizon Client >
Preferences from the menu bar. You have three choices:
n
Never connect to untrusted servers. If any of the certificate checks fails, the client cannot connect
to the server. An error message lists the checks that failed.
n
Warn before connecting to untrusted servers. If a certificate check fails because the server uses a
self-signed certificate, you can click Continue to ignore the warning. For self-signed certificates, the
certificate name is not required to match the server name you entered in Horizon Client.
n
Do not verify server identity certificates. This setting means that no certificate checking occurs.
If the certificate checking mode is set to Warn, you can still connect to a server that uses a self-signed
certificate.
If an administrator later installs a security certificate from a trusted certificate authority, so that all
certificate checks pass when you connect, this trusted connection is remembered for that specific server.
In the future, if that server ever presents a self-signed certificate again, the connection fails. After a
particular server presents a fully verifiable certificate, it must always do so.
Configuring Certificate Checking for End Users
You can configure the certificate verification mode so that, for example, full verification is always
performed.
Certificate checking occurs for SSL connections between Connection Server and Horizon Client. You can
configure the verification mode to use one of the following strategies:
n
End users are allowed to choose the verification mode. The rest of this list describes the three
verification modes.
n
(No verification) No certificate checks are performed.
n
(Warn) End users are warned if a self-signed certificate is being presented by the server. Users can
choose whether or not to allow this type of connection.
n
(Full security) Full verification is performed and connections that do not pass full verification are
rejected.
VMware Horizon Client for Mac Installation and Setup Guide
VMware, Inc. 18