Configure a CA-Signed Certificate for the Horizon Cloud Connector Virtual Appliance

For enhanced security, you can configure a custom CA-signed certificate for the Horizon Cloud Connector virtual appliance.

Note: This page's steps are specific for Horizon Cloud Connector versions 2.x. If you are running an earlier version, we strongly recommended updating to the latest version.

Prerequisites

• Verify that the full certificate chain is available in the PEM format.
• Ensure that the PEM file is generated with the private key instead of the passphrase.
• Verify that the FQDN and Subject Alt Name is included in the issued certificate.

Procedure

1. Open an SSH session to your deployed Horizon Cloud Connector virtual appliance.

2. Copy the CA-signed certificate in the directory /root/server.crt.

3. Copy the CA-signed key in the directory /root/server.key.

4. Back up the existing certificate.

cp /opt/container-data/certs/hze-nginx/server.crt /opt/container-data/certs/hze-nginx/server.crt.orig

5. Back up the existing key.

cp /opt/container-data/certs/hze-nginx/server.key /opt/container-data/certs/hze-nginx/server.key.orig

6. Copy the existing nginx conf file.

cp /opt/container-data/conf/hze-nginx/nginx.conf /opt/container-data/conf/hze-nginx/nginx.conf.orig

7. Copy the CA certificate in the appropriate directory for your virtual appliance version.

cp /root/server.crt /opt/container-data/certs/hze-nginx/server.crt

8. Copy the CA certificate key file in the appropriate directory for your virtual appliance version.

cp /root/server.key /opt/container-data/certs/hze-nginx/server.key

9. Verify the owner and permissions for the certificate and key file.

chown -R hze-nginx:hze-nginx /opt/container-data/certs/hze-nginx 
chmod 644 /opt/container-data/certs/hze-nginx/server.crt 
chmod 600 /opt/container-data/certs/hze-nginx/server.key

10. Verify that the issued FQDN in the certificate matches the server name directive in the server listen 443 block in the nginx configuration file. The nginx configuration file is located at /opt/container-data/conf/hze-nginx/nginx.conf.

11. Verify and restart nginx.

    kubectl rollout restart daemonset hze-nginx -n hze-system
    

12. Update the SSL thumbprints in the welcome screen. Follow the steps according to your version of Horizon Cloud Connector:

For version 2.5 or later, run the command /opt/horizon/bin/configure-login-screen.py. Then restart the appliance to pick up the changes and display the updated welcome screen.

For version 2.0 through 2.4, locate the configure-welcome-screen.py script in a bin directory within the /opt/ directory structure. Change to that directory and run configure-welcome-screen.py. Then restart the appliance to pick up the changes and display the updated welcome screen.

13. Test the new certificate by reloading the Horizon Cloud Connector user interface URL in a Web browser.

14. If the certificate works correctly, remove the backed-up files.

    rm /opt/container-data/certs/hze-nginx/server.crt.orig 
    rm /opt/container-data/certs/hze-nginx/server.key.orig 
    rm /opt/container-data/conf/hze-nginx/nginx.conf.orig
    

15. Remove the copied CA certificates and key files in the root directory.

    Use the following commands:

    rm /root/server.crt
    

    rm /root/server.key