Using ECDSA Smart Card Certificates

Horizon Agent for Windows supports smart card single sign-on (SSO) with ECDSA certificates. Horizon Agent uses the Windows Cryptography API: Next Generation (CNG) Key Storage Provider (KSP) by default for both RSA and ECDSA certificates.

If the smart card’s KSP isn’t available, Horizon Agent falls back to the legacy Cryptographic Service Provider (CSP). If you set UseCryptoAPI, Horizon Agent always uses the CSP. The legacy Microsoft CryptoAPI doesn’t support ECDSA, so ECDSA certificates work only through the KSP path. For more information, see Using the Legacy Microsoft CryptoAPI Standard.

Requirements for ECDSA Smart Card SSO

• Horizon Agent 2609 or later on a Windows virtual desktop.
• Horizon Client and Connection Server 2606 or later.
• A smart card and minidriver that support ECDSA certificates through the KSP. ECDSA smart card SSO has been tested with YubiKey devices running firmware 5.7.4 or later and the Yubico smart card minidriver.
• The Windows Group Policy setting Allow ECC certificates to be used for logon and authentication enabled on both the client machine and the virtual desktop.
• A user account that can sign in to the virtual desktop with the smart card through native Windows Remote Desktop Protocol (RDP).

Configure Client and Agent Machines for ECDSA Smart Cards

Before you configure Horizon, make sure the same smart card, certificate, minidriver, user account, and virtual desktop work with native Windows RDP. If native RDP sign-in fails, the problem is in the certificate or smart card setup, not in Horizon Agent.

Prerequisites

• Load an ECDSA smart card logon certificate, issued by your certificate authority, onto the smart card.
• Get the Yubico smart card minidriver installer. See Installing on Standalone Systems in the YubiKey Smart Card Minidriver User Guide.

Procedure

1. On the client machine, install the Yubico smart card minidriver.
2. On the virtual desktop, install the Yubico smart card minidriver with the INSTALL_LEGACY_NODE=1 command-line parameter. For instructions, see the Yubico documentation.
3. On both the client machine and the virtual desktop, enable the Group Policy setting Allow ECC certificates to be used for logon and authentication. This setting is in Computer Configuration > Administrative Templates > Windows Components > Smart Card. For more information, see Smart Card Group Policy and Registry Settings in the Microsoft documentation.
4. On the client machine, insert the smart card and run certutil -scinfo. Confirm that the ECDSA certificate is detected and validated.
5. From the client machine, use native Windows RDP to connect to the virtual desktop. Sign in with the smart card.
   If sign-in fails with the message “The sign-in method you’re trying to use isn’t allowed on this PC,” confirm that the user is allowed to sign in through Remote Desktop Services, for example by being a member of the Remote Desktop Users group on the virtual desktop.
6. Connect to the virtual desktop with Horizon Client and sign in with the smart card.

Results

The user signs in to the virtual desktop with the ECDSA smart card certificate without entering credentials again.

What to do next

If the ECDSA certificate isn’t used for SSO, check the Horizon Agent log for this message:

Cert in container '<container>' uses ECDSA which is not supported by the Crypto API. Skipping cert. Use CNG path instead.

This message means Horizon Agent is using the CryptoAPI path, for example because UseCryptoAPI is set. ECDSA certificates require the KSP path. To use ECDSA smart card SSO, remove the UseCryptoAPI setting. If your smart card minidriver supports only the CSP, it can’t be used with ECDSA certificates.