V-286747

Discussion

The Horizon Connection Server can be configured to check the revocation status of Public Key Infrastructure (PKI) certificates over both online certificate status protocol (OCSP) and certificate revocation list (CRL). This capability is disabled by default and must be enabled post-deployment. There are also a number of other configurations that are supported, including OCSP and CRL location override but those will be site and architecture specific. The recommended configuration is OCSP with failover to CRL and override the AIA locations via a local OCSP responder, if present. Note: The Horizon Connection Server OCSP implementation currently only supports a single certificate authority (CA) hierarchy, so an intermediate CA cannot be used. Additionally, all certificates must be signed by the same Root CA. Example settings: enableRevocationChecking=true ocspCRLFailover=true ocspSendNonce=true enableOCSP=true allowCertCRLs=false crlLocation=http://<crl.myagency.mil> ocspURL=http://<ca.myagency.mil/ocsp> ocspSigningCert=<ca.myagency.mil.cer> Set enableRevocationChecking to true to enable smart card certificate revocation checking. Set ocspCRLFailover to enable CRL checking if OCSP fails. Set ocspSendNonce to true to prevent OCSP repeated responses. Set enableOCSP to true to enable OCSP certificate revocation checking. Set allowCertCRLs to false to disable pulling the CRL distribution point from the certificate. Set crlLocation to the URL to use for the CRL distribution point. Set ocspURL to the URL of the OCSP Responder. Set ocspSigningCert to the location of the file that contains the OCSP Responder's signing certificate.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor. Find the "enableRevocationChecking" setting. Verify it is set as follows: 

enableRevocationChecking=true

If "enableRevocationChecking" is missing or is not set to "true", this is a finding.