Configure the PCoIP Secure Gateway to Use a New TLS Certificate

To comply with industry or jurisdiction security regulations, you can replace the default TLS certificate that is generated by the PCoIP Secure Gateway (PSG) service with a certificate that is signed by a CA.

In Omnissa Horizon 8, the PSG service creates a default, self-signed TLS certificate when the service starts up. The PSG service presents the self-signed certificate to clients running Omnissa Horizon Client 5.2 for Windows or later releases that connect to the PSG.

The PSG also provides a default legacy TLS certificate that is presented to clients running older clients or earlier releases that connect to the PSG.

The default certificates provide secure connections from client endpoints to the PSG and do not require further configuration in Omnissa Horizon Console. However, configuring the PSG service to use a CA-signed certificate is highly recommended, particularly for deployments that require you to use security scanners to pass compliance testing.

Although it is not required, you are most likely to configure new CA-signed TLS certificates for your servers before you replace the default PSG certificate with a CA-signed certificate. The procedures that follow assume that you already imported a CA-signed certificate into the Windows certificate store for the server on which the PSG is running.

Note: If you are using a security scanner for compliance testing, you might want to start by setting the PSG to use the same certificate as the server and scan the Horizon 8 port before the PSG port. You can resolve trust or validation issues that occur during the scan of the View port to ensure that these issues do not invalidate your test of the PSG port and certificate. Next, you can configure a unique certificate for the PSG and do another scan.

Configuring TLS Certificates for Horizon 8 Servers

Omnissa strongly recommends that you configure TLS certificates for authentication of Omnissa Horizon Connection Server instances.

1. Verify That the Server Name Matches the PSG Certificate Subject Name
   When a Horizon Connection Server instance is installed, the installer creates a registry setting with a value that contains the FQDN of the computer. You must verify that this value matches the server name part of the URL that security scanners use to reach the PSG port. The server name also must match the subject name or a subject alternate name (SAN) of the TLS certificate that you intend to use for the PSG.

2. Configure a PSG Certificate in the Windows Certificate Store
   To replace the default PSG certificate with a CA-signed certificate, you must configure the certificate and its private key in the Windows local computer certificate store on the Horizon Connection Server computer on which the PSG is running.

3. Set the PSG Certificate Friendly Name in the Windows Registry
   The PSG identifies the TLS certificate to use by means of the server name and certificate Friendly name. You must set the Friendly name value in the Windows registry on the Horizon Connection Server computer on which the PSG is running.

4. Force a CA-Signed Certificate to Be Used for Connections to the PSG
   You can ensure that all client connections to the PSG use the CA-signed certificate for the PSG instead of the default legacy certificate. This procedure is not required to configure a CA-signed certificate for the PSG. Take these steps only if it makes sense to force the use of a CA-signed certificate in your Horizon deployment.