5.2

A View Connection Server instance performs certificate revocation checking on its own certificate and on those
of
the security servers paired to it. By default, the VMware View Connection Server Service is started with the
LocalSystem account. When it runs under LocalSystem, a View Connection Server instance cannot use the proxy
settings configured in Internet Explorer to access the CRL DP URL or OCSP responder to determine the
revocation status of the certificate.
You can use Microsoft Netshell commands to import the proxy settings to the View Connection Server instance
so that the server can access the certificate revocation checking sites on the Internet.
Solution
1 On the View Connection Server computer, open a command-line window with the Run as
administrator setting.
For example, click Start, type cmd, right-click the cmd.exe icon, and select Run as administrator.
2 Type netsh and press Enter.
3 Type winhttp and press Enter.
4 Type show proxy and press Enter.
Netshell shows that the proxy was set to DIRECT connection. With this setting, the View Connection
Server computer cannot connect to the Internet if a proxy is in use in your organization.
5 Configure the proxy settings.
For example, at the netsh winhttp> prompt, type import proxy source=ie.
The proxy settings are imported to the View Connection Server computer.
6 Verify the proxy settings by typing show proxy.
7 Restart the VMware View Connection Server Service.
8 On the View Administrator dashboard, verify that the security server or View Connection Server icon is
green.
Troubleshooting Smart Card Certificate Revocation Checking
The View Connection Server instance or security server that has the smart card connected cannot perform
certificate revocation checking on the server's SSL certificate unless you have configured smart card certificate
revocation checking.
Problem
Certificate revocation checking might fail if your organization uses a proxy server for Internet access, or if a
View Connection Server instance or security server cannot reach the servers that provide revocation checking
because of firewalls or other controls.
IMPORTANT Make sure the CRL file is up to date.
Cause
View supports certificate revocation checking with certificate revocation lists (CRLs) and with the Online
Certificate Status Protocol (OCSP). A CRL is a list of revoked certificates published by the CA (Certificate
Authority)
that issued the certificates. OCSP is a certificate validation protocol that is used to get the revocation
status of an X.509 certificate. The CA must be accessible from the View Connection Server or security server
host. This issue can only occur if you configured revocation checking of smart card certificates. See “Using
Smart Card Certificate Revocation Checking,” on page 165.
VMware Horizon View Administration
396 VMware, Inc.