Although they may be confusing and require a lot of extra work to set up, SSL certificate play a key role in any VMware environment. The purpose of the certificates is to secure communications between the clients and the servers as well as between the servers themselves.
Certificates are needed on all of the major components of Horizon View and vCenter. The certificates that are installed on vCenter Server, Composer, and the Connection Servers can come from an internal certificate authority. If you are running Security Servers, or if you have a Bring-Your-Own—Beer Device environment, you’ll need to look at purchasing certificates from a public certificate authority.
Setting up a certificate authority is beyond the scope of this article. If you are interested in learning more about setting up your own public key infrastructure, I’ll refer you to Derek Seaman, the VMware Community’s own SSL guy. He recently released a three-part series about setting up a two-tier public key infrastructure on Windows Server 2012 R2. I’ve also found this instruction set to be a good guide for setting up a public key infrastructure on Windows Server 2008 R2.
Improved Certificate Handling
Managing SSL certificates was a pain if you’ve worked with previous versions of Horizon View. In previous versions, the certificates had be placed into a Java keystore file. This changed with View 5.1, and the certificates are now stored in the Windows Certificate Store. This has greatly improved the process for managing certificates.
Where to Get Certificates
Certificates can be minted on internal certificate authorities or public certificate authorities. An internal certificate authority exists inside your environment and is something that you manage. Certificates from these authorities won’t be trusted unless you deploy the root and intermediate certificates to the clients that are connecting.
The certificates used on a security server should be obtained from a commercial certificate vendor such as Thawte, GoDaddy, or Comodo. One option that I like to use in my lab, and that I’ve used in the past when I didn’t have a budget for SSL certificates is StartSSL. They provide free basic SSL certificates.
Generating Certificate Requests for Horizon View Servers
VMware’s methods for generating certificates for Horizon View is different than vCenter. When setting up certificate requests for vCenter, you need to use OpenSSL to generate the requests. Unlike vCenter, Horizon View uses the built-in Windows certificate tools are used to generate the certificate requests. VMware has a good PDF document that walks through generating certificates for Horizon View. An online version of this article also exists.
Before we can generate a certificate for each server, we need to set up two things. The first is a certificate template that can be used to issue certificates in our public key infrastructure. I’m not an expert on public key infrastructure, so I’ll defer to the expert again.
The other thing that we need to create is a CSR configuration file. This file will be used with certreq.exe to create the certificate signing request. The template for this file, which is included in the VMware guide, is below.
;----------------- request.inf -----------------
[Version]
Signature="$Windows NT$"
[NewRequest]
Subject = "CN=View_Server_FQDN, OU=Organizational_Unit_Name, O=Organization_Name, L=City_Name, S=State_Name, C=Country_Name" ; replace attributes in this line using example below
KeySpec = 1
KeyLength = 2048
; Can be 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
FriendlyName = "vdm"
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
[RequestAttributes]
; SAN="dns=FQDN_you_require&dns=other_FQDN_you_require"
;-----------------------------------------------
The subject line contains some fields that we need to fill in with information from our environment. These fields are:
- CN=server_fqdn: This part of the Subject string should contain the fully qualified domain name that users will use when connecting to the server. An example for an internal, non-Internet facing server is internalbroker.internaldomain.local. An internet-facing server should use the web address such as view.externaldomain.com
- OU=organizational unit: I normally fill in the responsible department, so it would be IT.
- O=Organization: The name of your company
- L=City: The city your office is based in
- S=State: The name of the State that you’re located in. You should spell out the name of the state since some CAs will not accept abbreviated names.
- C=Country: The two-letter ISO country code. The United States, for example, is US.
A CSR configuration file will need to be created for each server with a Horizon View Component installed. vCenter will also need certificates, but there are different procedures for creating and installing vCenter certificates depending on whether you are using the Windows application or the vCenter appliance.
Creating the certificate signing request requires the certreq.exe command line tool. These steps will need to be performed on each connection server, security server, and The steps for generating the request are:
- Open a command prompt as an Administrator on your View server. Note: This command should be run from the server where you want the certificate to reside. It can be done from another machine, but it makes it more complicated.
- Navigate to the folder where you stored the request.inf file.
- Run the following command: certreq.exe –new request.inf server_name_certreq.txt
After the certificate request has been created, it needs to be submitted to the certificate authority in order to have the SSL certificate generated. The actual process for submitting the CSR is beyond the scope of this article since this process can vary in each environment and with each commercial vendor.
Importing the Certificate
Once the certificate has been generated, it needs to be imported into the server. The import command is:
certreq.exe –accept certname.cer
This will import the generated certificate into the Windows Certificate Store.
Using the Certificates
Now that we have these freshly minted certificates, we need to put them to work in the View environment. There are a couple of ways to go about doing this.
1. If you haven’t installed the Horizon View components on the server yet, you will get the option to select your certificate during the installation process. You don’t need to do anything special to set the certificate up.
2. If you have installed the Horizon View components, and you are using a self-signed certificate or a certificate signed from a different CA, you will need to change the friendly name of the old certificate and restart the Connection Server or Security Server services.
Horizon View requires the certificate to have a friendly name value of vdm. The template that is posted above sets the friendly name of the new certificate to vdm automatically, but this will conflict with any existing certificates.
Friendly Name
The steps for changing the friendly name are:
- Go to Start –> Run and enter MMC.exe
- Go to File –> Add/Remove Snap-in
- Select Certificates and click Add
- Select Computer Account and click Finish
- Click OK
- Right click on the old certificate and select Properties
- On the General tab, delete the value in the Friendly Name field, or change it to vdm_old
- Click OK
- Restart the View service on the server
Certificates and View Composer
Unfortunately, Horizon View Composer uses a different method of managing certificates. Although the certificates are still stored in the Windows Certificate store, the process of replacing Composer certificates is a little more involved than just changing the friendly name.
The process for replacing or updating the Composer certificate requires a command prompt and the SVIConfig tool. SVIConfig is the Composer command line tool. If you’ve ever had to remove a missing or damaged desktop from your View environment, you’ve used this tool.
The process for replacing the Composer certificate is:
- Open a command prompt as Administrator on the Composer server
- Change directory to your VMware View Composer installation directory
Note: The default installation directory is C:\Program Files (x86)\VMware\VMware View Composer - Run the following command: sviconfig.exe –operation=replacecertificate –delete=false
- Select the correct certificate from the list of certificates in the Windows Certificate Store
- Restart the Composer Service
A Successful certificate swap
At this point, all of your certificates should be installed. If you open up the View Administrator web page, the dashboard should have all green lights.
If you are using a certificate signed on an internal CA for servers that your end users connect to, you will need to deploy your root and intermediate certificates to each computer. This can be done through Group Policy for Windows computers. If you’re using Teradici PCoIP Zero Clients, you can deploy the certificates as part of a policy with the management VM. If you don’t do this, users will not be able to connect without disabling certificate checking in the client.
The Virtual Horizon 