Rule ID
SV-286743r1291392_rule
Version
V1R1
Systems operating on DoW networks must establish trust only with certificates issued by approved Public Key Infrastructure (PKI) certification authorities. Certificates issued by untrusted, self-signed, or nonapproved certification authorities cannot provide the level of identity assurance required for DoW operations and may allow attackers to impersonate legitimate services, conduct man-in-the-middle attacks, or intercept sensitive communications. The Horizon Connection Server uses X.509 certificates to authenticate its identity to Horizon Clients and other Horizon components. If the server presents a certificate that is not issued by a DoW-approved internal or external certification authority, clients may be unable to establish trust in the server's identity, or users may become accustomed to accepting untrusted certificates, increasing the risk of successful spoofing or credential theft. By default, the Horizon Connection Server is installed with a self-signed certificate intended only for initial deployment and testing. Production deployments must replace the default certificate with one issued by a DoW-approved certification authority. The certificate must be installed and configured for Horizon use in accordance with Omnissa Horizon documentation, including assignment of the required "vdm" friendly name. Satisfies: SRG-APP-000427-AS-000264, SRG-APP-000514-AS-000137
1. On the Horizon Connection Server, open "certlm.msc" (Certificate Management - Local Computer). Certificate management for the current user will not work. 2. Select Personal >> Certificates. 3. In the right pane, locate the certificate with the "Friendly Name" of "vdm". 4. For this certificate, locate the issuer in the "Issued By" column. If the Horizon Connection Server broker certificate is not "Issued By" a trusted DoW certificate authority (CA), this is a finding.
1. Obtain a web server certificate from a DoW authority, specifying the common name as the Horizon Connection server FQDN, the signing algorithm as "SHA384" or "SHA512", and the key strength of at least "1024 bits". 2. Export the certificate and private key to a password-protected PFX bundle. 3. On the Horizon Connection Server, open "certlm.msc" or "certmgr.msc" (Certificate Management - Local Computer). 4. Rename the existing certificate, if it exists: a. Select Personal >> Certificates, then in the right pane, locate the certificate with the "Friendly Name" of "vdm". b. Right-click this certificate, select "Properties", and change the "Friendly name" to "vdm-original" or something similar. c. Click "OK". 5. Import the new certificate: a. Right-click on the Personal >> Certificates folder. b. Select All Tasks >> Import. c. Click "Next", then "Browse..." and navigate to the .pfx bundle and click "Open". d. Click "Next", supply the password, select "Mark this key as exportable" and "Include all extended properties", then click "Next", "Next", then "Finish". e. Right-click on the newly imported certificate, select "Properties", then change the "Friendly name" to "vdm" (this name must match exactly in name and case). f. Click "OK". 6. Restart the connection server or the Omnissa Horizon Connection Server service for changes to take effect. NOTE: FIPS mode requires either "SHA384" or "SHA512" for the signing algorithm. If a UAG is in use in the environment and it has been configured to meet NIAP/CFFC requirements, using a signing algorithm of "SHA512" may cause issues.