6.1

Procedure
1 When View Administrator displays an Invalid Certificate Detected dialog box, click View Certificate.
2 Examine the certificate thumbprint in the Certificate Information window.
3 Examine the certificate thumbprint that was configured for the vCenter Server or View Composer
instance.
a On the vCenter Server or View Composer host, start the MMC snap-in and open the Windows
Certificate Store.
b Navigate to the vCenter Server or View Composer certificate.
c Click the Certificate Details tab to display the certificate thumbprint.
Similarly, examine the certificate thumbprint for a SAML authenticator. If appropriate, take the
preceding steps on the SAML authenticator host.
4 Verify that the thumbprint in the Certificate Information window matches the thumbprint for the
vCenter Server or View Composer instance.
Similarly, verify that the thumbprints match for a SAML authenticator.
5 Determine whether to accept the certificate thumbprint.
Option Description
The thumbprints match.
Click Accept to use the default certificate.
The thumbprints do not match.
Click Reject.
Troubleshoot the mismatched certificates. For example, you might have
provided an incorrect IP address for vCenter Server or View Composer.
Configuring Horizon Client Connections
Client endpoints communicate with a View Connection Server or security server host over secure
connections.
The initial client connection, which is used for user authentication and remote desktop and application
selection, is created over HTTPS when a user provides a domain name to Horizon Client. If firewall and
load balancing software are configured correctly in your network environment, this request reaches the
View Connection Server or security server host. With this connection, users are authenticated and a desktop
or application is selected, but users have not yet connected to the remote desktop or application.
When users connect to remote desktops and applications, by default the client makes a second connection to
the View Connection Server or security server host. This connection is called the tunnel connection because
it provides a secure tunnel for carrying RDP and other data over HTTPS.
When users connect to remote desktops and applications with the PCoIP display protocol, the client can
make a further connection to the PCoIP Secure Gateway on the View Connection Server or security server
host. The PCoIP Secure Gateway ensures that only authenticated users can communicate with remote
desktops and applications over PCoIP.
You can also provide secure connections to external users who use HTML Access to connect to remote
desktops. The Blast Secure Gateway ensures that only authenticated users can communicate with remote
desktops. With HTML Access, Horizon Client software does not have to be installed on the users' endpoint
devices.
Depending on the type of client device being used, additional channels are established to carry other traffic
such as USB redirection data to the client device. These data channels route traffic through the secure tunnel
if it is enabled.
Chapter 8 Configuring View for the First Time
VMware, Inc. 103