Configuring Advanced TLS Options

You can select the security protocols and cryptographic algorithms that are used to encrypt communications between Omnissa Horizon Client and Omnissa Horizon Connection Server or Omnissa Unified Access Gateway instances, and between Horizon Client and Horizon Agent in a remote desktop.

Supported TLS Protocols

Horizon Client supports the TLS 1.1, TLS 1.2, and TLS 1.3 security protocols. Older protocols such as TLS 1.0, SSL 2.0, and SSL 3.0 are not supported.

The supported protocols are also used to encrypt the USB channel (communication between the USB service daemon and the agent).

With the default settings, cipher suites use 128-bit or 256-bit AES, remove anonymous DH algorithms, and then sort the current cipher list in order of encryption algorithm key length.

Default TLS Settings

Horizon Client uses the following default TLS settings:

Before changing any TLS settings from the defaults, review the guidelines and limitations described in this section.

If you configure security protocols for Horizon Client and none of these protocols are enabled on the Horizon Connection Server or Unified Access Gateway instance to which the client connects, a TLS error occurs and the connection fails.

Important: At least one of the protocols that you enable in Horizon Client must also be enabled on the remote desktop or USB devices cannot be redirected to the remote desktop.

Configuring Advanced TLS Settings

Note: Before changing any TLS settings from the defaults, review the Guidelines for Configuring TLS Settings.

On the client system, you can configure security protocols and cryptographic algorithms using one of the following methods.

• If an administrator has allowed it, you can access the advanced settings window by starting Horizon Client and selecting File > Preferences > Advanced from the menu bar.

  The advanced settings window allows you to selectively enable one or more protocols, specify cipher suites, and restore the default security settings.

• To use configuration file properties, use the following properties:

  • view.sslProtocolString
  • view.sslCipherString
  • view.disableTLSv13
  • view.sslCipherSuites For more information, see Using the horizon-client Command-Line Interface and Configuration Files and look up the property names in the table in Horizon Client Configuration Settings and Command-Line Options.

• To use command-line configuration options, use the following options.

  • --sslProtocolString=
  • --sslCipherString=
  • --disableTLSv13
  • --sslCipherSuites= For more information, see Using the horizon-client Command-Line Interface and Configuration Files and look up the option names in the table in Horizon Client Configuration Settings and Command-Line Options.