You must follow certain guidelines for configuring TLS certificates for Horizon 8 servers and related components.
Omnissa Horizon Connection Server
TLS is required for client connections to a server. Client-facing Horizon Connection Server instances and intermediate servers that terminate TLS connections require TLS server certificates.
By default, when you install Horizon Connection Server, the installation generates a self-signed certificate for the server. However, the installation uses an existing certificate in the following cases:
- If a valid certificate with a Friendly name of
vdmalready exists in the Windows Certificate Store - If you upgrade to Horizon 8 from an earlier release, and a valid keystore file is configured on the Windows Server computer, the installation extracts the keys and certificates and imports them into the Windows Certificate Store.
vCenter Server
Before you add vCenter Server to Horizon 8 in a production environment, make sure that vCenter Server uses certificates that are signed by a CA.
For information about replacing the default certificate for vCenter Server, see "Certificate Replacement in Large Deployments" in the vSphere Authentication document on the VMware vSphere Documentation site.
PCoIP Secure Gateway
To comply with industry or jurisdiction security regulations, you can replace the default TLS certificate that is generated by the PCoIP Secure Gateway (PSG) service with a certificate that is signed by a CA. Configuring the PSG service to use a CA-signed certificate is highly recommended, particularly for deployments that require you to use security scanners to pass compliance testing. See Configure the PCoIP Secure Gateway to Use a New TLS Certificate.
Blast Secure Gateway
By default, the Blast Secure Gateway (BSG) uses the TLS certificate that is configured for the Horizon Connection Server instance on which the BSG is running. If you replace the default, self-signed certificate for a server with a CA-signed certificate, the BSG also uses the CA-signed certificate.
Enrollment Server
(Horizon 8 2209 and later) TLS is required for connections to an enrollment server from Horizon Connection Server. By default, Enrollment Server generates a self-signed certificate for the server. However, the installation uses an existing certificate if a valid certificate with a Friendly name of vdm.es already exists in the Windows Certificate Store.
Database Server
(Horizon 8 2209 and later) To enable TLS for communication with a Database server used to host Event DB, make sure that the Database server uses a certificate signed by a CA. Refer to documentation from the respective database provider to set up the TLS certificate on the database servers.
SAML 2.0 Authenticator
Omnissa Access uses SAML 2.0 authenticators to provide Web-based authentication and authorization across security domains. If you want Horizon 8 to delegate authentication to Omnissa Access, you can configure Horizon 8 to accept SAML 2.0 authenticated sessions from Omnissa Access. When Omnissa Access is configured to support Horizon 8, Omnissa Access users can connect to remote desktops by selecting desktop icons on the Horizon User Portal.
In Omnissa Horizon Console, you can configure SAML 2.0 authenticators for use with Horizon Connection Server instances.
Before you add a SAML 2.0 authenticator in Horizon Console, make sure that the SAML 2.0 authenticator uses a certificate that is signed by a CA.
Additional Guidelines
For general information about requesting and using TLS certificates that are signed by a CA, see Benefits of Using TLS Certificates Signed by a CA.
When client endpoints connect to a Horizon Connection Server instance, they are presented with the server's TLS server certificate and any intermediate certificates in the trust chain (intermediate certificates are in the Horizon Connection Server's Windows Intermediate Certification Authorities store). To trust the server certificate, the client systems must have installed the root certificate of the signing CA.
vCenter Server does not present an intermediate certificate while making a TLS connection. Horizon Connection Server Instances should have those intermediate Certificates in its Windows 'Intermediate Certification Authorities' store. See Knowledge Base article 2108294.
Similarly, if a SAML 2.0 authenticator is configured for Horizon Connection Server, the Horizon Connection Server computer must have installed the root certificate of the signing CA for the SAML 2.0 server certificate.
Was this page helpful?