To accomplish pairing, you can use the MMC Certificates snap-in to export automatically generated, self-signed Enrollment Service Client certificate from one connection server in the cluster. This certificate is called a client certificate because the connection server is a client of the Enrollment Service provided by the enrollment server.

Enrollment Service must trust the VMware Horizon Connection Server when it prompts the Enrollment Servers to issue the short lived certificates for Active Directory users. Hence, the VMware Horizon Connection Server clusters or pods must be paired with Enrollment Servers.

The Enrollment Service Client certificate is automatically created when a Connection Server is installed and the VMware Horizon Connection Server service starts. The certificate is distributed through Horizon LDAP to other Connection Servers that get added to the cluster later. The certificate is then stored in a custom container (VMware Horizon Certificates\Certificates) in the Windows Certificate Store on the computer.

Prerequisites

Verify that you have a Connection Server. For installation instructions, see the Horizon Installation document. For upgrade instructions, see the Horizon Upgrades document.

Important: Customers can use their own certificates for pairing, rather than using the self-generated certificate created by the connection server. To do so, place the preferred certificate (and the associated private key) in the custom container ( VMware Horizon Certificates\Certificates) in the Windows Certificate Store on the connection server machine. You must then set the friendly name of the certificate to vdm.ec.new, and restart the server. The other servers in the cluster will fetch this certificate from LDAP. You can then perform the steps in this procedure.

Procedure

  1. On one of the Connection Server machines in the cluster, add the Certificates snap-in to MMC:
    1. Open the MMC console and select File > Add/Remove Snap-in
    2. Under Available snap-ins, select Certificates and click Add.
    3. In the Certificates snap-in window, select Computer account, click Next, and click Finish.
    4. In the Add or Remove Snap-in window, click OK.
  2. In the MMC console, in the left pane, expand the VMware Horizon Certificates folder and select the Certificates folder.
  3. In the right pane, right-click the certificate file with the friendly name vdm.ec, and select All Tasks > Export.
  4. In the Certificate Export wizard, accept the defaults, including leaving the No, do not export the private key radio button selected.
  5. When you are prompted to name the file, type a file name such as EnrollClient, for Enrollment Service Client certificate, and follow the prompts to finish exporting the certificate.

What to do next

Import the certificate into the enrollment server. See Import the Enrollment Service Client Certificate on the Enrollment Server.