User manual

4 Copy the selected thumbprint to a text le.
For example: 31 2a 32 50 1a 0b 34 b1 65 46 13 a8 0a 5e f7 43 6e a9 2c 3e
N When you copy the thumbprint, do not to include the leading space. If you inadvertently paste
the leading space with the thumbprint into the registry key (in Step 7), the certicate might not be
congured successfully. This problem can occur even though the leading space is not displayed in the
registry value text box.
5 Start the Windows Registry Editor on the desktop where the HTML Access Agent is installed.
6 Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config registry key.
7 Modify the SslHash value and paste the certicate thumbprint into the text box.
8 Reboot Windows.
When a user connects to a desktop through HTML Access, the HTML Access Agent presents the CA-signed
certicate to the user's browser.
Configure HTML Access Agents to Use Specific Cipher Suites
You can congure the HTML Access Agent to use specic cipher suites instead of the default set of ciphers.
By default, the HTML Access Agent requires incoming SSL connections to use encryption based on certain
ciphers that provide strong protection against network eavesdropping and forgery. You can congure an
alternative list of ciphers for the HTML Access Agent to use. The set of acceptable ciphers is expressed in the
OpenSSL format. which is described at hps://www.openssl.org/docs/apps/ciphers.html.
Procedure
1 Start the Windows Registry Editor on the desktop where the HTML Access Agent is installed.
2 Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config registry key.
3 Add a new String (REG_SZ) value, SslCiphers, and paste the cipher list in the OpenSSL format into the
text box.
4 Restart the VMware Blast service to make your changes take eect.
In the Windows guest operating system, the service for the HTML Access Agent is called VMware Blast.
To revert to using the default cipher list, delete the SslCiphers value and restart the VMware Blast service.
Do not simply delete the data part of the value because the HTML Access Agent will then treat all ciphers as
unacceptable, in accordance with the OpenSSL cipher list format denition.
When the HTML Access Agent starts, it writes the cipher denition in the VMware Blast service's log le.
You can discover the current default cipher list by inspecting the logs when the VMware Blast service starts
with no SslCiphers value congured in the Windows Registry.
The HTML Access Agent's default cipher denition might change from one release to the next to provide
improved security.
Configuring iOS to Use CA-Signed Certificates
To use HTML Access on iOS devices, you need to install SSL certicates that are signed by a Certicate
Authority (CA) instead of the default SSL certicates that are generated by the View Connection Server or
the HTML Access Agent.
For instructions, see "Congure Horizon Client for iOS to Trust Root and Intermediate Certicates" in the
View Installation document.
Using HTML Access
16 VMware, Inc.