6.4

Certificate Pairing
Before broker agents can communicate with the View adapter, the adapter certicate must be shared with
the agents, and the broker agent certicate must be shared with the adapter. The process of sharing these
certicates if referred to as certicate pairing.
The following actions occur during the certicate pairing process:
1 The broker agent's certicate is encrypted with the adapter's server key.
2 A connection is opened to the certicate management server and the encrypted certicate is passed to
the adapter instance. The adapter decrypts the broker agent's certicate by using the server key. If
decryption fails, an error is returned to the broker agent.
3 The broker agent's certicate is placed in the adapter's trust store.
4 The adapter's certicate is encrypted with the adapter's server key.
5 The encrypted certicate is returned to the broker agent. The broker agent decrypts the adapter's
certicate by using the server key. If decryption fails, an error is returned to the user.
6 The adapter's certicate is placed in the broker agent's trust store. The broker certicate is stored in v4v-
brokeragent.jks and the adapter certicate is stored in v4v-truststore.jks.
7 The adapter's certicate is sent to all remote desktops and RDS hosts in the Horizon pod by using the
Horizon conguration store.
8 When the agent on the remote desktop or RDS host reads the Horizon conguration, it places the
adapter's certicate in the agent's trust store.
After the certicates are successfully paired, they are cached in the trust stores for each individual
component. If a new remote desktop is provisioned, the adapter's certicate is sent to the desktop by using
the Horizon conguration store, and you do not need to pair the certicates again. However, if either the
adapter or broker agent certicate changes, you must pair the certicates again.
You use the vRealize Operations View Broker Agent Seings wizard to pair certicates. For more
information, see the VMware vRealize Operations for Horizon Administration document.
Reissue Horizon Desktop Authentication Tokens
If you believe that the security of your Horizon environment might be compromised, you can issue a new
authentication token for each desktop virtual machine and RDS host in your Horizon environment by
restarting the Broker Agent service. By default, a new authentication token for each desktop virtual machine
and RDS host is issued every hour.
SSL/TLS and Authentication-Related Log Messages
The View adapter logs SSL/TLS conguration and authentication-related messages.
Table 4‑5. View Adapter Log Message Types
Log Message Type Description
CONFIGURATION The SSL/TLS conguration this currently being used.
AUTHENTICATION SUCCESS A remote desktop has been successfully authenticated.
AUTHENTICATION FAILED A remote desktop has failed authentication.
Only CONFIGURATION and AUTHENTICATION FAILED events are wrien to the log by default. To
troubleshoot problems, you can raise the logging level to log other types of events.
Chapter 4 Managing Authentication in vRealize Operations for Horizon
VMware, Inc. 21