V-286729

Discussion

Preventing the disclosure of transmitted information requires that the application server take measures to employ strong cryptographic mechanisms to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. According to NIST and as of publication, TLS 1.1 must not be used and TLS 1.2 must be configured. Note: Mandating TLS 1.2 may affect certain client types. Test and implement carefully. Satisfies: SRG-APP-000014-AS-000009, SRG-APP-000439-AS-000155, SRG-APP-000440-AS-000167, SRG-APP-000442-AS-000259

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor. 

4. Find the "secureProtocols.1" and "preferredSecureProtocol" settings. Verify they are set as follows:

secureProtocols.1=TLSv1.2
preferredSecureProtocol=TLSv1.2

If the "secureProtocols.1" and "preferredSecureProtocol" are not exactly as above, this is a finding.