Manage Blast Self-Signed Certificate Lifetime and Renewal

By default, when a Horizon Agent with Blast installed is deployed on a Windows system, Blast generates and uses its own self-signed certificate for TLS server identification. This certificate is retained across Horizon Agent upgrades and is used to secure Blast connections unless replaced by a certificate from the administrator.

These self-signed certificates can expire. The Blast Agent does not check certificate expiration dates and keeps showing expired certificates. This can cause client or middlebox rejections, alarms during security audits, and make your experience worse. The current fixed lifetime of 820 days complied with an earlier version of that standard.

Automatic Replacement of Expiring Self-Signed Certificates
Starting with the Horizon 2506 release, the Blast Agent includes support for automatic replacement of its self-signed certificate before expiration. This capability is active by default and is intended to improve long-term maintainability in large deployments where manual intervention is impractical.

When the service starts, the Blast Service checks whether it is using a self-signed certificate and evaluates its expiration date. If the certificate is set to expire within a configurable lead time, the service automatically generates and uses a new self-signed certificate. This new certificate is stored and used for all future connections until it approaches expiration. The default replacement lead time is 90 days.

Configuration Settings for Certificate Renewal
There are two Blast configuration settings that control the automatic renewal of self-signed certificates. TlsCertSelfSignRenewAdvanceDays: This is the number of days before the current certificate expires. The Blast Agent will think that certificate can be renewed. The certificate will be replaced during the first Blast Agent restart after the eligibility period has been entered.

• Default: 90, which means that a certificate becomes eligible for replacement 90 days prior to the certificate’s expiration date.
• Minimum: 0
• Maximum: 1100

TlsCertSelfSignLifetimeDays: defines the number of days a newly generated certificate will be valid. The expiration date of the new certificate is calculated as the current time plus this number of days.

• Default: 390
• Minimum: 1
• Maximum: 1100

Both settings can be configured in the Windows Registry and through a Group Policy Object (GPO) using the Horizon Blast GPO template.

Registry path: HKLM\Software\Omnissa\Horizon\Blast\Config
Value type: REG_SZ, following the established Blast conventions.

Note: Local Registry settings take precedence over GPO-defined values.