Certificate Management

You can generate a CSR as well as import, export, delete and restore certificates from the Certificate Management pane.

Procedure

1. From the Horizon Console, select Certificate Management.

2. Perform these actions on a certificate by clicking the appropriate button at the top of the Certificate Management listing.

   Action	Description
   Generate CSR	See Create a CSR Configuration File from Horizon Console for details.
   Import	See "Set up an Imported Certificate from the Horizon Console" in the Horizon Installation and Upgrade guide for details.
   Export	When a certificate is selected, a dialog box displays. Select Machine or Cluster for Certificate Usage, then enter the password for the certificate to export. Note: Only an in-use certificate can be exported.
   Delete	Select the certificate that is in Valid or Invalid state and click Delete. A confirmation message displays indicating that this action is temporary and the certificate can be restored. Click OK to change the certificate status to ‘Deleted’, click Cancel to cancel the action. To permanently delete the certificate, select the certificate that is in ‘Deleted’ state and click Delete. A confirmation message displays indicating that this action is permanent and the certificate cannot be restored once it is deleted. Click OK to continue, click Cancel to cancel the action. This action is also available from the Certificate Management Summary screen.
   Restore	Select the Deleted state certificate that you want to restore, and click Restore. This action is also available from the Certificate Management Summary screen.

Configure Certificate Lifetime

You can configure custom lifetime values for the cluster identity certificate (vdm.ec) and the cluster encryption certificate (vdm.enc) directly from the Horizon Console. These lifetime settings apply when certificates are self-managed or auto-managed.

Configuring certificate lifetimes is independent of the SAML key sharing feature. The vdm.ec and vdm.enc certificates are used for purposes beyond SAML, and the lifetime configuration applies regardless of whether SAML key sharing is enabled or disabled.

For background on the underlying LDAP attributes that these settings correspond to, see Horizon - How to Change SAML Certificate Validity Period When Shared Entity ID (Single Metadata) Is Enabled (6001515).

Prerequisites

• Verify that you have the Manage Certificate privilege. Users without this privilege can view the certificate lifetime settings in read-only mode but cannot make changes.
• Verify that you are running Horizon 8 version 2609 or later. The REST APIs for getting and setting certificate lifetime values are available starting with release 2609.

Procedure

1. From the Horizon Console, navigate to Global Settings > Security Settings > Certificate Settings.

2. Select Certificate Lifetime from the Certificate Settings dropdown menu.

   The Certificate Lifetime modal opens, displaying the current configured values for both certificate types.

3. Configure the lifetime values as needed.

   Field	Description	Supported Range
   Cluster Identity	Configures the lifetime of the cluster identity/signing certificate (vdm.ec).	365 to 3,650 days
   Cluster Encryption	Configures the lifetime of the cluster encryption certificate (vdm.enc).	1 to 540 days

   The modal displays the following informational text:

   Configure the lifetime for cluster identity and cluster encryption certificates (applies when certificates are self-managed / auto-managed).

4. Enter the desired lifetime value in days for either or both fields. Neither field is mandatory; you can configure one or both as needed.

5. Click OK to save the changes, or click Cancel to close the dialog without saving.

   The OK button is enabled only when at least one lifetime value has changed, all entered values are valid, and all values are within their respective supported ranges. Invalid, out-of-range, or incorrectly formatted values display inline validation messages and prevent saving.

6. After a successful save, the Horizon Console displays the following message:

   Successfully updated Certificate Lifetime settings.

Results

The certificate lifetime settings take effect the next time the corresponding certificates are generated or renewed. These settings do not change the validity period of certificates that are already active.

Read-Only Access

Users without the Manage Certificate privilege can open the Certificate Lifetime modal to view the current configured values. In read-only mode:

• The lifetime fields cannot be edited.
• No update request is sent.
• The modal provides a Close action instead of the editable OK/Cancel workflow.