← Back to Omnissa Horizon Connection Server Security Technical Implementation Guide

V-286762

CAT II (Medium)

The PC over IP (PCoIP) Secure Gateway must be configured with a DoW-issued Transport Layer Security (TLS) certificate.

Rule ID

SV-286762r1291663_rule

STIG

Omnissa Horizon Connection Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

The DoW will only accept PKI certificates obtained from a DoW-approved internal or external certificate authority (CA). If the CA used for verifying the certificate is not a DoW-approved CA, trust of the CA will not be established. The PCoIP Secure Gateway supports the replacement of the default, self-signed certificate with one issued by a DoW CA. This is accomplished through the normal Windows Server certificate management tools. For simplicity, it is recommended to use the same certificate as previously configured for the connection server itself via the certificate with the "vdm" friendly name.

Check Content

1. On the Horizon Connection Server, launch the Registry Editor.

2. Traverse the registry tree to "HKEY_LOCAL_MACHINE\SOFTWARE\Teradici\SecurityGateway".

3. Locate the "SSLCertWinCertFriendlyName" key.

If "SSLCertWinCertFriendlyName" does not exist, this is a finding.

If "SSLCertWinCertFriendlyName" is set to "vdm", this is not a finding.

4. If "SSLCertWinCertFriendlyName" is present, but the value is not set to "vdm", perform the following steps:

Note the value of "SSLCertWinCertFriendlyName". This is the friendly name of the PCoIP Secure Gateway certificate.

a. On the Horizon Connection Server, open "certlm.msc" or "certmgr.msc" (Certificate Management - Local Computer).

b. Select Personal >> Certificates.

c. In the right pane, locate the certificate with the "Friendly Name" of the previously noted value of "SSLCertWinCertFriendlyName".

d. For this certificate, locate the issuer in the "Issued By" column.

If the PCoIP Secure Gateway certificate is not "Issued By" a trusted DoW CA, this is a finding.

Note: If the PCoIP Secure Gateway is not enabled, this is not applicable.

Fix Text

1. On the Horizon Connection Server, launch the Registry Editor.

2. Traverse the registry tree to "HKEY_LOCAL_MACHINE\SOFTWARE\Teradici\SecurityGateway".

Option One - Use the same certificate as the connection server:

1. Create a new String (REG_SZ) key named "SSLCertWinCertFriendlyName".

2. Set its value to "vdm".

Option Two - Use a different certificate for the PCoIP Secure Gateway:

1. Create a new String (REG_SZ) key named "SSLCertWinCertFriendlyName".

2. Set its value ("pcoip", for example).

3. Obtain a web server certificate from a DoW CA, specifying the common name as the Horizon Connection server FQDN, the signing algorithm as "SHA256" and the key strength of at least "1024 bits".
 
4. Export the certificate and private key to a password-protected PFX bundle.

5. Right-click on the Personal >> Certificates folder.

6. Select All Tasks >> Import.

7. Click "Next", then "Browse...", then navigate to the .pfx bundle and click "Open".

8. Click "Next", supply the password, select "Mark this key as exportable" and "Include all extended properties", then click "Next", "Next", and "Finish".

9. Right-click the newly imported certificate and select "Properties".

10. Change the "Friendly name" to what was set earlier ("pcoip", for example). This name must be exact in name and case, as set above. Click "OK".

11. Restart the "Omnissa Horizon PCoIP Security Gateway" service for changes to take effect.