Rule ID
SV-286737r1291374_rule
Version
V1R1
CCIs
The Horizon Connection Server performs certificate revocation checking on its own certificate and on those of the security servers paired to it. Each instance also checks the certificates of vCenter and VDI machines whenever it establishes a connection to them. If a SAML 2.0 authenticator is configured for use by a connection server instance, the connection server also performs certificate revocation checking on the SAML 2.0 server certificate. By default, all certificates in the chain are checked except the root certificate. This must be changed so that the full path, including the root, is validated.
1. On the Horizon Connection Server, launch the Registry Editor. 2. Traverse the registry tree to "HKEY_LOCAL_MACHINE\Software\Omnissa\Horizon\Security". 3. Locate the "CertificateRevocationCheckType" key. If the "CertificateRevocationCheckType" key does not exist, this is a finding. If the "CertificateRevocationCheckType" key does not have a value of "3", this is a finding.
1. On the Horizon Connection Server, launch the Registry Editor. 2. Traverse the registry tree to "HKEY_LOCAL_MACHINE\Software\Omnissa\Horizon\Security". 3. If the "CertificateRevocationCheckType" key exists: a. Right-click "CertificateRevocationCheckType", select "Modify...", and set the value to "3". b. Click "OK". 4. If the "CertificateRevocationCheckType" key does not exist: a. Right-click on the "Security" folder and select "New", then "String Value". b. Set the name to "CertificateRevocationCheckType". c. Right-click "CertificateRevocationCheckType", select "Modify..." and set the value to "3". d. Click "OK". 5. Restart the Omnissa Horizon Connection Server service for changes to take effect.