When you receive updated server TLS certificates or intermediate certificates, you import the certificates into the Windows local computer certificate store on each Connection host.
Typically, server certificates expire after 12 months. Root and intermediate certificates expire after 5 or 10 years.
Attention: If you are replacing the certificate with a new certificate provider, you must update the server thumbprints. Failure to do so will result in a total loss of service. For information about updating thumbprints, see "Configure Horizon Settings" in the
Deploying and Configuring VMware Unified Access Gateway guide.
Prerequisites
- Obtain updated server and intermediate certificates from the CA before the currently valid certificates expire.
- Verify that the Certificate snap-in was added to MMC on the Windows Server on which the Connection Server instance was installed.
Procedure
- Import the signed TLS server certificate into the Windows local computer certificate store on the Windows Server host.
- In the Certificate snap-in, import the server certificate into the folder.
- Select Mark this key as exportable.
- Click Next and click Finish.
- For Connection Server, delete the certificate Friendly name, vdm, from the old certificate that was issued to the VMware Horizon server.
- Right-click the old certificate and click Properties
- On the General tab, delete the Friendly name text, vdm.
- For Connection Server, add the certificate Friendly name, vdm, to the new certificate that is replacing the previous certificate.
- Right-click the new certificate and click Properties
- On the General tab, in the Friendly name field, type vdm.
- Click Apply and click OK.
- If intermediate certificates are issued to a Connection Server host, import the most recent update to the intermediate certificates into the folder in the Windows certificate store.
- Restart the VMware Horizon Connection Server service to make your changes take effect.
