Install a CA-signed Certificate for BlastServer Daemon on a Linux Machine

By default, the Horizon Agent for Linux installer generates a self-signed certificate for the BlastServer daemon, which handles communications with clients using the Blast display protocol. To comply with industry or security regulations, you can replace the self-signed certificate for BlastServer with a certificate that is signed by a Certificate Authority (CA).

• When the Blast Security Gateway is not enabled on the Horizon Connection Server, BlastServer presents the default self-signed certificate to the browser that uses HTML Access to connect to the Linux desktop.
• When the Blast Security Gateway is enabled on the Horizon Connection Server, the Blast Security Gateway presents its certificate to the browser.

To replace the default self-signed certificate for BlastServer with a CA-signed certificate, you can use one of the following methods.

• BCFKS keystore: With this method, you use the DeployBlastCert.sh deployment script to store the certificate and private key in an encrypted Bouncy Castle FIPS keystore (BCFKS) in the ssl directory.
• Unencrypted storage: With this method, you manually copy the certificate and private key, without encryption, to the root level of the ssl directory.

The BlastServer daemon first looks in the Linux keyring for the certificate and private key from a BCFKS keystore. If it does not find a BCFKS keystore, it then reads the certificate and private key stored at the root level of ssl directory.

Deploy the BlastServer CA Certificate to a BCFKS Keystore

The DeployBlastCert.sh deployment script creates a new BCFKS keystore whose name contains the string blast.bcfks in the ssl directory and stores the certificate and private key in this keystore. The information in the keystore is then added to the Linux keyring.

1. Use the SSLCertName and SSLKeyName configuration options to customize the certificate name and private key name, respectively, as they will appear in the Linux keyring. For more information, see Table 2 in Edit Configuration Files on a Linux Desktop.

2. Run the DeployBlastCert.sh deployment script, as shown in the following example.

   Find the location of the DeployBlastCert.sh script within the /usr directory structure and make note of its path.

   The following example uses path-to-deployblastcert to represent that path. Issue the command using the path on your machine.

   sudo /path-to-deployblastcert/DeployBlastCert.sh -c /root/rui.cert -k /root/rui.key
   

   Use the following parameter flags for the deployment script:

   Parameter Flag	Description
   -c	Specifies the CA-signed certificate file.
   -k	Specifies the private key file.

Deploy the BlastServer CA Certificate to Unencrypted Storage

1. Add the private key and the CA-signed certificate to ssl directory.

Note: The ssl directory for the following steps is typically located within the /etc file structure.

a.  Rename the private key to **rui.key** and the certificate to **rui.crt**.
b.  Set read and executable permissions on the `ssl` directory.

    ```
    sudo chmod 550 ssl
    ```

c.  Copy **rui.key** and **rui.crt** to `ssl`.
d.  Remove executable permissions on `ssl`.

    ```
    sudo chmod 440 ssl
    ```

2. Install the root and intermediate CA certificates into the Linux OS Certificate Authority store.

For information about other system settings that must be changed to support the CA certificate chain, refer to the documentation for your Linux distribution.