Configure a Cluster Identity Certificate

At installation, Omnissa Horizon Connection Server generates a self-signed Cluster Identity certificate. This is used by connection servers to prove cluster membership for purposes such as site redirection and enrollment server integration. It is refreshed automatically (see Certificate Thumbprint Verification and Automatic Certificate Generation or you can replace the self-signed certificate with a CA-signed certificate.

When using True SSO the Cluster Identity certificate is used for securing communication between Horizon Connection Server and the enrollment server. If you are replacing this certificate with a CA-signed certificate, the new certificate should be imported to the enrollment server and the Root CA certificate should be added to the Trusted Root Certification Authorities store on the enrollment server. For more information see the "Setting Up True SSO" section in the Omnissa Horizon 8 Administration document.

Procedure

1. Generate a CA-signed certificate meeting the requirements below. It is strongly recommended that you perform this task from the Admin Console. See Generate a CSR and Request a Signed Certificate from a CA for details.

   Note: The root certificate used to generate the client certificate should be added to Trusted Root Certification Authorities store on all Horizon Connection Servers in the POD.

   • Subject name: Cluster GUID

     You can find Cluster GUID using the vdmadmin -C command or navigating to Horizon Connection Server Cluster GUID under HKEY_LOCAL_MACHINE\SOFTWARE\Omnissa\Horizon\Node Manager.

     Note: If a dnsName SAN can be created, its value should be the Cluster GUID. The certificate’s Subject field can then be set to anything, there is no restriction at all.

     If a SAN cannot be created, then the format of the Subject field is important. It should be a DN comprising a DNS name that begins with the Cluster GUID (for example: CN=guid.company.com).

   • SAN: Cluster GUID of Horizon pod as DNSName

   • EKU: Server authentication, Client authentication

   • Set friendly name: vdm.ec.new

   • Private key must be marked exportable.

   • Certificate must be added to Certificates (Local Computer) > Omnissa Horizon Certificates > Certificates.

   • Signature algorithm to use: SHA384/SHA512

2. Import the certificate chain to corresponding folders.

3. Delete the existing cluster certificate with friendly name vdm.ec.

4. Restart Horizon Connection Server service.

Results

When the Horizon Connection Server has accepted the new certificate, the friendly name of the certificate will change from vdm.ec.new to vdm.ec. If the certificate is not accepted for any reason the old certificate will be moved from LDAP to the Windows certificate store. The other servers in the cluster will fetch this certificate from LDAP.