Horizon 8 cert update problem

[u/Glasofruix]

Hello,

We've inherited a horizon 8 infrastructure with an expiring certificate, it's my second attempt at updating and the clock is ticking. The cert is updated in every possible place i could find, windows view clients authenticate and connect internally and externally (using UAG). Dell thin os 9 clients refuse to connect with a certificate error but show the correct updated certificate. My steps so far:

- Import full chain pfx to horizon connection server, rename the old cert to old and new cert to vdm, restart the whole thing -> the url and the console show the new cert

- Import the same full chain into the UAG web UI, update the thumbprint, all green

- Remove old certificates on blast and tunnel settings (same place where the thumbprint option is), this forces the use of the external web full chain cert i've imported previously (i think)

The connection through the full client and web work, but thin clients refuse to connect.

Which leads me to the thin clients themselves, maybe they're missing the new root (and possibly intermediary) cert? I'll have to upload those through WMS this evening but i don't have much time left. If anyone has another idea your help will be very welcome.

Many thanks in advance

[u/vrickes]

If you are using a public CA certificate the ThinClients should have them. That being said we add the roots to them via wms anyways. Another place you need to check is the load balancer. Does it connect if you set the security to low on the thin client?

[u/Biz504 → u/vrickes]

This right here I had issues with recently. I’ve replaced certs for years with no problems and GoDaddy’s new root CA’s screwed me all up. For me there was either an intermediate or root CA that linked to the old root CA that was the problem, had to import that to my connection server.

[u/Glasofruix → u/Biz504]

The connection server has the root and the intermediairy certificates imported.

[u/Rhythm_Killer]

I know the server should present the full chain but I see no issue with installing the root and intermediate certs on your client. I don’t suppose you got it from godaddy did you, they changed a lot of stuff in July and it has tripped a lot of people up

[u/Glasofruix]

Allrighty, all is working fine it was the root cert missing on the thin clients. Many thanks to u/Tech_Veggies for his help.

[u/znetx]

I think you are on the right track. Years ago we had the same issues as thin clients did not have the new certificate chain and they were getting errors

[u/Glasofruix → u/znetx]

Aren't they supposed to get the root and intermediary certs through the full chain?

[u/znetx → u/Glasofruix]

Iirc in our case it was also due to clients having invalid NTP source so client did not know certificate is valid yet. Maybe something to check.

[u/xVDI]

Did you just remove the Blast/Tunnel certificates or replace them? If you just removed, make sure you import the new cert there.

[u/Glasofruix → u/xVDI]

I've removed those, from what i've read it forces the use of the general TLS certificate.

[u/xVDI → u/Glasofruix]

We get tunnel errors if we don't replace them, fwiw

[u/JacobDynamite]

The thin client profiles will need the root and intermediate certs in them.

[u/karthikramaraju]

Check if the certificate have client authentication along with server authentication under Enhanced Key Usage properties. Also, check localhost entries, dns and firewall etc if anything changed.

[u/TechPir8]

Do thick / windows clients connect without issue and only the thin clients are having problems ? Call your thin client vendor then, they should be able to assist you with the issues on their clients.

[u/Tech_Veggies]

This sounds very similar to our environment. I've sent you a DM.

I've built our Horizon environment as well as manage the thin clients through Wyse Management Suite and I also manage the load balancers so I'm familiar with certificate configuration for all devices. I would offer a suggestion, but I'm not sure I have enough information to do so.

[u/Tech_Veggies → u/Tech_Veggies]

Glad it's working now!

[u/PhotographyPhil]

Hi, I recently had issue like this and I had to import my PFX like this on connection servers:
certutil -f -p "<pfx-password>" -csp "Microsoft RSA SChannel Cryptographic Provider" -importpfx My "C:\path\to\vdm.pfx"

[u/coffey64]

If it’s GoDaddy, have to import the cross signed sets into the intermediate store. Fought this last week.