V-287317

Discussion

The Horizon Client connects to the Connection Server, UAG, or other gateway via a Transport Layer Security (TLS) connection. This initial connection must be trusted; otherwise, the sensitive information flowing over the tunnel could potentially be open to interception. The Horizon Client can be configured to ignore any certificate validation errors, warn, or fail. By default, the Client will warn and let the user decide whether to proceed or not. This decision must not be left to the end user. In a properly configured, enterprise environment, there must be no issues with the presented certificate. Allowing the end user to click through any errors allows a TLS connection to be intercepted and subjected to a man-in-the-middle attack.

Check Content

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings.

Double-click "Certificate verification mode".

If "Certificate verification mode" is set to "Not Configured" or "Disabled", this is a finding.

If the drop-down menu for "Certificate verification mode" is not set to "Full Security", this is a finding.