Administrators and sometimes end users can configure whether client connections are rejected if any or some server certificate checks fail.

Certificate checking occurs for SSL connections between View Connection Server and Horizon Client. Certificate verification includes the following checks:

  • Has the certificate been revoked?

  • Is the certificate intended for a purpose other than verifying the identity of the sender and encrypting server communications? That is, is it the correct type of certificate?

  • Has the certificate expired, or is it valid only in the future? That is, is the certificate valid according to the computer clock?

  • Does the common name on the certificate match the host name of the server that sends it? A mismatch can occur if a load balancer redirects Horizon Client to a server that has a certificate that does not match the host name entered in Horizon Client. Another reason a mismatch can occur is if you enter an IP address rather than a host name in the client.

  • Is the certificate signed by an unknown or untrusted certificate authority (CA)? Self-signed certificates are one type of untrusted CA.

    To pass this check, the certificate's chain of trust must be rooted in the device's local certificate store.

Note:

For instructions about distributing a self-signed root certificate to all Windows client systems in a domain, see the topic called "Add the Root Certificate to Trusted Root Certification Authorities" in the View Installation document.

If your administrator has allowed it, you can set the certificate checking mode. On the Horizon Client home screen, swipe in from the right to display the charms list, tap Settings > General settings. You have three choices:

  • Never connect to untrusted servers. If any of the certificate checks fails, the client cannot connect to the server. An error message lists the checks that failed.

  • Warn before connecting to untrusted servers. If a certificate check fails because the server uses a self-signed certificate, you can click Continue to ignore the warning. For self-signed certificates, the certificate name is not required to match the View Connection Server name you entered in Horizon Client.

  • Attempt to connect regardless of server identity certificates. This level is the same as the Warn before connecting to untrusted servers level, except that no warning is displayed. The connection continues without requiring users to click Continue.

Because the certificate mechanism used in Windows Store apps is more limited than for Windows desktop applications, the certification check can fail even if the level is set to Warn before connecting to untrusted servers or Attempt to connect regardless of server identity certificates. For example, the certification check can fail rather than warn for the following reasons:

  • The certificate signed by the root CA has been revoked.

  • The certificate signed by the intermediate CA has been revoked.

  • The certificate is valid but the intermediate CA has been revoked.

  • The certificate in the chain contains an unknown extension that is marked "critical".