Add the CA Certificate to a Server Truststore File

You must add root certificates, intermediate certificates, or both to a server truststore file for all users and administrators that you trust. Horizon Connection Server instances use this information to authenticate smart card users and administrators.

Prerequisites

• Obtain the root or intermediate certificates that were used to sign the certificates on the smart cards presented by your users or administrators. See Obtain the Certificate Authority Certificates and Obtain the CA Certificate from Windows.

  Important: These certificates can include intermediate certificates if the user's smart card certificate was issued by an intermediate certificate authority.

• Verify that the keytool utility is added to the system path on your Horizon Connection Server host. See the Horizon Installation and Upgrade document for more information.

Procedure

1. On your Horizon Connection Server host, use the keytool utility to import the root certificate, intermediate certificate, or both into the server truststore file.

   For example: keytool -import -alias alias -file root_certificate -keystore truststorefile.key -storetype JKS

   In this command, alias is a unique case-sensitive name for a new entry in the truststore file, root_certificate is the root or intermediate certificate that you obtained or exported, and truststorefile.key is the name of the truststore file that you are adding the root certificate to. If the file does not exist, it is created in the current directory.

   Note: The keytool utility might prompt you to create a password for the truststore file. You will be asked to provide this password if you need to add additional certificates to the truststore file at a later time.

2. Copy the truststore file to the SSL gateway configuration folder on the Horizon Connection Server host.

   For example: install_directory\View\Server\sslgateway\conf\truststorefile.key

What to do next

Modify Horizon Connection Server configuration properties to enable smart card authentication.

Previous topic:Obtain the CA Certificate from Windows

Next topic:Modify Horizon Connection Server Configuration Properties