Configure Security Protocols and Cipher Suites for PCoIP Secure Gateway (PSG)

You can configure the security protocols and cipher suites that PSG's client-side listener accepts by editing the registry. If required, this task can also be performed on a RDS host.

Important: The security settings for Connection Server do not apply to PSG. You must configure security for PSG separately.

The supported protocols are as follows:

Older protocols such as SSLv3 and earlier are never allowed.

You must specify cipher suites using the format defined in OpenSSL. PSG uses two registry values for cipher configuration:

Procedure

1. On the Horizon Connection Server instance or RDS host, open a registry editor and navigate to:

   HKLM\Software\Teradici\SecurityGateway
   

2. Add or edit the REG_SZ registry value SSLProtocol to specify the list of allowed protocols, separated by colons.

   Example: To enable TLS 1.2 and TLS 1.3 (default in non-FIPS mode, Horizon 8 version 2312 and later):

   tls1.3:tls1.2
   

   To enable only TLS 1.2 (default in FIPS mode):

   tls1.2
   

3. Add or edit the REG_SZ registry value SSLCipherList to specify the list of allowed cipher suites for TLS 1.1 and TLS 1.2.

   Example:

   ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:@STRENGTH
   

   If this value is not set or is empty, PSG automatically constructs the cipher list based on the SSLDisableAES128 and SSLDisableRSACipher settings.

4. (Horizon 8 version 2312 and later) Add or edit the REG_SZ registry value SSLCiphersuites to specify the list of allowed cipher suites for TLS 1.3.

   Example:

   TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:@STRENGTH
   

   If this value is not set or is empty, PSG uses the default TLS 1.3 cipher suite list: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:@STRENGTH.

5. Add or edit the REG_SZ registry value SSLDisableAES128 to filter cipher suites that negotiate a 128-bit AES encryption key. If not defined, the value defaults to 0, meaning that the filter will not be applied. To exclude these cipher suites, turn on the filter by setting the registry value to 1.

   Note: This setting only applies to TLS 1.1/1.2 cipher suites (SSLCipherList). It does not affect TLS 1.3 cipher suites (SSLCiphersuites).

6. Add or edit the REG_SZ registry value SSLDisableRSACipher to filter cipher suites that use RSA for key exchange. If not defined, the value defaults to 1, meaning that these cipher suites will be filtered from the list. If it is necessary to include them, turn off the filter by setting the registry value to 0.

   Note: This setting only applies to TLS 1.1/1.2 cipher suites (SSLCipherList) when SSLCipherList is not explicitly set. It does not affect TLS 1.3 cipher suites (SSLCiphersuites).

Important: If SSLCipherList is set to a non-empty value by the administrator, PSG uses it directly for TLS 1.1/1.2 connections, and the SSLDisableAES128 and SSLDisableRSACipher filter settings are ignored.

For detailed configuration steps, see PCoIP General Settings.