Rule ID
SV-286748r1291657_rule
Version
V1R1
CCIs
PKI certificates have visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.
On the Horizon Connection Server, launch a command prompt as an administrator and execute the following commands: cd "C:\Program Files\Omnissa\Horizon\Server\sslgateway\conf" "C:\Program Files\Omnissa\Horizon\Server\jre\bin\keytool.exe" -list -keystore trust.store -storepass password -v|find "Owner" If any certificates in the keystore are from a non-DoW issuer, this is a finding. Note: By default, Horizon Connection Server installs to "C:\Program Files". If this was changed, modify the commands above to point to the installation directory with the "Omnissa" root. Note: The store password is not security-relevant but can be changed, if so desired. Note: The trust store file name may be different for the site.
1. On the Horizon Connection Server, export all current DoW root and intermediate CAs in "base64, .cer" format to one directory, such as "C:\Certs". Launch a command prompt as an administrator and execute the following commands:
cd C:\Certs
for /f %a in ('dir *.cer /b') do @"C:\Program Files\Omnissa\Horizon\Server\jre\bin\keytool.exe" -import -alias %a -file %a -keystore trust.store -noprompt -storepass password -storetype jks
move trust.store "C:\Program Files\Omnissa\Horizon\Server\sslgateway\conf" /Y
2. Navigate to "C:\Program Files\Omnissa\Horizon\Server\sslgateway\conf" and open "locked.properties" in a text editor. Verify the following lines are present:
trustKeyfile=trust.store
trustStoretype=jks
useCertAuth=true
3. Save the file, if necessary.
Note: By default, Horizon Connection Server installs to "C:\Program Files". If this was changed, modify the commands above to point to the installation directory with the "Omnissa" root.
Note: The store password is not security relevant but can be changed, if so desired.
4. Copy the keystore to all Horizon Connection Servers in the system and repeat the process to verify the settings in "locked.properties" on each. Omit this step if multiple connections servers are not used.
5. Restart the Omnissa Horizon Connection Server service for changes to take effect.