Configure a Cluster Identity Certificate

At installation, Omnissa Horizon Connection Server generates a self-signed Cluster Identity certificate. This is used by connection servers to prove cluster membership for purposes such as site redirection and enrollment server integration. It is refreshed automatically (see Certificate Thumbprint Verification and Automatic Certificate Generation or you can replace the self-signed certificate with a CA-signed certificate.

When using True SSO the Cluster Identity certificate is used for securing communication between Horizon Connection Server and the enrollment server. If you are replacing this certificate with a CA-signed certificate, the new certificate should be imported to the enrollment server and the Root CA certificate should be added to the Trusted Root Certification Authorities store on the enrollment server. For more information see the "Setting Up True SSO" section in the Omnissa Horizon 8 Administration document.

Prerequisite

Know your Cluster GUID before beginning. You can find the Cluster GUID using the vdmadmin -C command or navigating to Horizon Connection Server Cluster GUID under HKEY_LOCAL_MACHINE\SOFTWARE\Omnissa\Horizon\Node Manager.

Procedure

1. Generate a CA-signed certificate meeting the requirements below. It is strongly recommended that you perform this task from the Admin Console. See Set up an Imported Certificate from Horizon Console for details.

   Note: The root certificate used to generate the client certificate should be added to the Trusted Root Certification Authorities store on all Horizon Connection Servers in the POD.

   • SAN:dNSName:guid (where guid is the Cluster GUID)

   • Subject: CN=guid.company.com (where guid is the Cluster GUID and company.com is any DNS domain name).

     Note that this format is deprecated and should be used only if a SubjectAlternateName (SAN) field cannot be included in the certificate. When a dNSName SAN field is included as described above, Subject can be set to anything, for example the name of the pod.

   • EKU: Server authentication, Client authentication

   • Signature algorithm: SHA256 or better (for Common Criteria approved configuration, use SHA384 or better)

   • Set friendly name: vdm.ec.new

   • Private key must be marked exportable.

   • Certificate must be added to Certificates (Local Computer) > Omnissa Horizon Certificates > Certificates.

2. Delete the existing cluster certificate with friendly name vdm.ec.

3. Restart Horizon Connection Server service.

Results

When the Horizon Connection Server has accepted the new certificate, the friendly name of the certificate will change from vdm.ec.new to vdm.ec. If the certificate is not accepted for any reason the old certificate will be moved from LDAP to the Windows certificate store. The other servers in the cluster will fetch this certificate from LDAP.