Configure Security Protocols and Cipher Suites for the Horizon Blast Windows Service

You can use the Windows Registry to configure the cipher suites and security protocols that the Horizon Blast Windows service uses.

The Blast Windows service supports the following security protocols, depending on the release version of Horizon Agent.

Older protocols such as SSLv3 and earlier are never allowed. Two registry values, SslProtocolLow and SslProtocolHigh, determine the range of protocols that the Blast Windows service accepts.

You must specify the list of ciphers using the format defined in OpenSSL. For guidelines on the proper cipher list format, search for openssl cipher string in a web browser. The default cipher lists are as follows:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256

TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256

Procedure

1. Start the Windows Registry Editor.

2. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Omnissa\Horizon\Blast\Config registry key.

3. To specify the range of protocols, add two new string (REG_SZ) values, SslProtocolLow and SslProtocolHigh.

   To enable only one protocol, specify the same protocol in the data field for both registry values. For example, setting SslProtocolLow=tls_1.3 and SslProtocolHigh=tls_1.3 configures the Blast Windows service to accept only TLS 1.3.

   Note: If a registry value does not exist, or if its data is not set to a supported protocol string, the default protocol settings are used. Supported protocol strings are as follows:

   • tls_1.3 (only for Horizon Agent 2312 and later)
   • tls_1.2
   • tls_1.1
   • tls_1.0 (only for Horizon Agent 2309 and earlier)

4. To specify a list of cipher suites, add a new string (REG_SZ) value as follows:

   • For TLS 1.1 or TLS 1.2, add the SslCiphers value.
   • For TLS 1.3, add the SslCipherSuites value. Type or paste the list of cipher suites in the data field of the registry value.

5. Restart the Blast Windows service.

Results

When the Blast Windows service starts, it writes the protocol and cipher information to its log file. You can examine the log file to determine the values that are in effect.

To revert to using the default cipher list, delete the SslCiphers or SslCipherSuites registry value and restart the Blast Windows service. Do not delete the data part of the value. If you delete the data part of the value, the Blast Windows service treats all ciphers as unacceptable in accordance with the OpenSSL cipher list format definition.

Note: The default protocols and cipher suites might change in accordance with evolving best practices for network security.