Installation and Setup Guide

n
Is the certificate signed by an unknown or untrusted certificate authority (CA)? Self-signed certificates
are one type of untrusted CA.
To pass this check, the certificate's chain of trust must be rooted in the device's local certificate store.
Note For information about distributing a self-signed root certificate to all Windows client systems in a
domain, see "Add the Root Certificate to Trusted Root Certification Authorities" in the View Installation
document.
To set the certificate checking mode, start Horizon Client and select Configure SSL in the Options menu
on the Horizon Client menu bar. You have three choices:
n
Never connect to untrusted servers. If any of the certificate checks fails, the client cannot connect
to the server. An error message lists the checks that failed.
n
Warn before connecting to untrusted servers. If a certificate check fails because the server uses a
self-signed certificate, you can click Continue to ignore the warning. For self-signed certificates, the
certificate name is not required to match the server name you entered in Horizon Client.
You can also receive a warning if the certificate has expired.
n
Do not verify server identity certificates. This setting means that no certificate checking occurs.
If the certificate checking mode is set to Warn, you can still connect to a server that uses a self-signed
certificate.
If an administrator later installs a security certificate from a trusted certificate authority, so that all
certificate checks pass when you connect, this trusted connection is remembered for that specific server.
In the future, if that server ever presents a self-signed certificate again, the connection fails. After a
particular server presents a fully verifiable certificate, it must always do so.
Important If you previously configured your company's client systems to use a specific cipher via GPO,
such as by configuring SSL Cipher Suite Order group policy settings, you must now use a Horizon Client
group policy security setting included in the ADMX template file. See Security Settings for Client GPOs.
You can alternatively use the SSLCipherList registry setting on the client. See Using the Windows
Registry to Configure Horizon Client.
Configuring Certificate Checking for End Users
You can configure the certificate verification mode so that, for example, full verification is always
performed.
Certificate checking occurs for SSL connections between Connection Server and Horizon Client. You can
configure the verification mode to use one of the following strategies:
n
End users are allowed to choose the verification mode. The rest of this list describes the three
verification modes.
n
(No verification) No certificate checks are performed.
VMware Horizon Client for Windows Installation and Setup Guide
VMware, Inc. 48