Names of certificate VMware View 6.1

Similar Questions

• How to fix VMware View Server certificate revocation check connection error?

  Dear community,

  For about 2 weeks, I feel a revocation of the certificate check error in our environment Horizon see 6.2. The strange thing is that, within 12 hours about two (replication) connection servers and the vCenter Server / server of composer (on the same machine) are considered as having invalid certificates, even if, in fact, they are valid (CA certificates). We use no security servers.

  The view admin console shows the following for servers connection:

  The server certificate is not approved.

  The server certificate cannot be verified.

  For the vCenter, he said (that I have validated manually the certificate):

  No problems found.

  Certificate is not approved, but the thumbprint of the certificate is accepted.

  With the connection series on 'full', States that the login server logs for the vCenter server:

  TRACE (B 17-0 - 0E98) < VCHealthUpdate > [NativeKeyVault] validateCertificateChain response: {result = FAIL, EndEntityReasons = cantCheckRevoked, ChainReasons = invalid, SelfSigned = false, EndErrorCode = 16777280, EndInfoCode = 258, ChainErrorCode = 16777280, ChainInfoCode = 256, PolicyErrorCode =-2146885613}

  As far as I can see there no similar entries for login server certificates in the newspaper.

  At the moment I am under the environment with composer and vCenter certificates manually valid and invalid connection (red) server certificates (as view clients and browsers are not disabled).

  I already checked that I am able to do everything 'green' again via setting the registry key 'CertificateRevocationCheckType'2 (as described here Configure the server certificates certificate revocation check). This brings me to the conclusion that one of the intermediate certificates cannot be validated. So, I had the information a "version" of an intermediate (intermediate certification authority) certificate has been revoked. There seems to be no coincidence - like the time point is as well, but this particular version does not appear to be used in the servers of my connection.

  However, even with full logging enabled, I can't information which (intermediate) certificate cannot be validated and why. I expected to see something like 'OCSP verification' or 'check the CRL' but I can't find it in the newspapers. However, I noticed that one of the intermediate certificates lacked the OCSP URL (even if the field "Authority Information Access" existed). Of course I updated the certificate with a version that contains the OCSP URL, but it has not changed anything.

  In addition, I checked manually all of the certificates in the chain with openssl (for OCSP) and CRLs as well, but everything seems to be OK (all URLS are accessible and no opportunity of certificate has been revoked). Actually, I do not interpret the error as "that the connection to the server is an invalid certificate because it has been revoked", but "it cannot check if it has been revoked. The servers do not need a proxy and nothing configured, so (I checked the proxy settings system context, also).

  For now, the problem is not critical, such as 'red' status connection server has no effect on our customers and so I could turn off certificate revocation check (or switch to check that the certificate of the server (2)). But of course, I would really solve the problem.

  Is there someone who can give me a hint on what to check, for example, how do I know which certificate cannot be controlled and why? Someone had the same or a similar problem? Support VMware is working on the problem as well, but they seem don't know is not the problem, either.

  I appreciate the thoughts and responses! Thank you!

  Best regards

  Fabian

  Dear community,

  During this time, I was able to correct the error described at the beginning of this thread. Jump to the end to see what could probably help you...

  1. At first, I installed an additional standalone VMware View Server connection in order to check the following related certificates:
     1. VMware support always told me to renew my certificates because they "were not valid" etc. - even if in fact they were (like external URL calls and attested manual verification and tests).
     2. That's why I created new additional certificates for the login server and configured to include the vCenter even as my production environment - only difference was I didn't inlcude the composer who runs the server vCenter himself.
     3. The result was that the server was "green" including both the vCenter Server certificate which could be 'not reliable' by the environment of production - strange, huh?
  2. After I reset the additional server to a turned wink where connection to the server was not yet installed (before that, I uninstalled the connection to the server in case there is information in vCenter thereon) and reinstalled as a replica of the production environment server. Somehow I expected this, but still quite strange the vCenter Server (and composer) now again was considered "invalid", even if the certificate of the server connection itself considered still valid and green. For test purposes, so I put certifice revocation checking on '2' (only one server certificate check) - but only on the 'old' production servers' and 'magical' everything has been considered valid. So as I see it, there seems to be some sort of information stored on the 'old' connection servers that makes them believe that invalid certificates and that the information is replicated on the third server unless I lower the revocation of the certificate controls on these servers. Altervative explanation could be that VMware View does not accept certificates with aliases that do not include the 'real' server name - that is / was in fact certificates the old servers connection. The new server certificate connection included the real name and the alias. I understand if this is the case, but then I expect that it be documented somewhere (I have not found this information) and also wouldn't understand why it worked without problem for several years before.
  3. After finding that out, I created new certificates for the 'old' connection servers, including aliases and real names and replaced the certificate on one of the servers (and restarted the login server) - only a few successfully. Once I put the revocation checking on '4' again on this server, the login server certificate was still considered valid, but not the vCenter and certificate of composer.
  4. Now, I've uninstalled the old login server (removed from the view) and reinstalled completely (including an update of the 2008 R2 2012 R2 OS) and after I have it reintegrated into the environment, everything remained green - as long I have will activate revocation checking on the second login server "old." This is why I did the same with this (completely reinstalled and reinstated it) and now everything is green with the revocation checking enabled on all replicas of server connection.
  5. The next step I uninstall the additional replica because I created only for troubleshooting purposes.

  So what will no doubt help in similar cases:

  • Reinstall the servers of connection one by one, including:
  • Uninstalling html access (if used), uninstall the login server to view, uninstall 'VMware' AD LDS Instance.
  • Removal of the connection to the server of replication group: run "s - r s uninstalled_ vdmadmin.exeservername" on one of the servers connection remaining.
  • Reinstall/Update OS (may not be necessary, but I did not test that)
  • Reininstall, return to the login server replica. If you used the certificates which included only the alias of the server I recommend you to create new ones, including the name of the server as well, but maybe it's not necessary as well. If you want to keep the certificates which only inlcude the alias it will be necessary to install this certificate after the first replication of the servers (see below).

  My question for technicians of VMware/developers: It is supported to use certificates include only the server alias. Otherwise why it worked before and where is it documented? Where are certificate cached information so that simply replace the certificate was only some, and not a complete success (see above). FYI - when I paired initially replicas that I had to install the CA (including only the pseudonym) after the first replication - now with certificates (including the server name and the alias), I could install the certificate before you replicate (= the login server installation).

• IPad Client for View 5 supports Subject Alternative Name (SAN) certificates?

  Does anyone know if the iPad App to see 5.0 Update for subject alternative name (SAN) certificates?  I tested a SAN certificate on a view Security Server 5.0, and it worked great for all the FQDN in the certificate when you use the view Windows 5.0-based Client.  However, when I try to connect using the iPad App, it seems to trust only the common name (CN) rather than additional complete domain names in the SAN certificate.  The nice thing about SAN certificates is that you can buy 1 certificate with a whole bunch of domain names and use the same certificate on multiple servers.  But this seems to break the view iPad customer.  Can anyone confirm that this is a limiation of the iPad App?  This should be corrected in a future release?  Or are we stuck buying individual certificates for each of our servers?

  I had this same problem.  I get mine from DigiCert, and they offer duplicate certificates.  I had a duplicate with my FQDN View Manager like CN first and installed.  After that, I was able to use it on the iPad.

• Problem with certificate on View Composer

  Hello

  I'll try to explain my problem as well as possible.

  I upgraded my server from 5.2 to 6.2 view composer. And I would like to replace the default certificate with my own build by my internal CA (on our domain controller).

  I created a requet.inf found here: VMware KB: using Microsoft Certreq to generate signed SSL certificates in VMware View Horizon

  And replace the CN, OR O, etc. by my information. Here is the content:

  - request.inf-
  [Version]
  
  Signature = $Windows NT$
  
  [NewRequest]
  
  Subject = "CN =View_Server_FQDN, OR =Organizational_Unit_Name, O =OrganizationName, L =City_Name, S =State_Name, C =Country_Name"; ". replace the attributes of this line with the help of example below
  KeySpec = 1
  KeyLength = 2048
  ; Can be 2048, 4096, 8192, or 16384.
  ; Larger key sizes are more secure, but have
  ; a greater impact on performance.
  Exportable = TRUE
  FriendlyName = vdm
  MachineKeySet = TRUE
  SMIME = False
  PrivateKeyArchive = FALSE
  UserProtected = FALSE
  UseExistingKeySet = FALSE
  ProviderName = Microsoft RSA SChannel Cryptographic Provider
  ProviderType = 12
  RequestType = PKCS10
  KeyUsage = 0xa0
  
  [EnhancedKeyUsageExtension]
  
  OID=1.3.6.1.5.5.7.3.1 ; This is for server authentication
  
  [RequestAttributes]
  
  ; SAN = dns =FQDN_you_require& dns =other_FQDN_you_require
  ;-----------------------------------------------

  
  

  After I generated the CSR with the following command: certreq-new request.inf certreq.txt

  
  

  After that I generated the certificate with our CA in DER64.

  
  

  In the MMC on the composer of server I import the certificate. Always go to the right.

  
  

  And the last thing is to replace the default certificate with the IVR command: SviConfig ReplaceCertificate

  
  

  It's done. I restart the composer server go to the dashboard to see the flag. But I got a redflag about the composer with the following message: the server certificate does not match the url

  
  

  I searched this message on Google and the error appear to be in the "NC", I checked the synthax and the name of the server (FQDN) are correctly write. I also see that we can use SAN (alternative name of the object).

  
  

  But I still got the same error.

  
  

  
  

  Anyone has an idea about this?

  
  

  Best regards
  

  Excuses that became automatic registered please ignore previous comment. Good now back instead on certificates of composer does not work as expected. Please share the result at the bottom of the step

  If you use the utility replace sviconfig from there to return to default certificates the certificate error disappears?

• Disable the protocols and encryption algorithms in VMware View connection server and security

  Hello

  In my recent deployment, I had a customer request to disable some protocols and encryption at the Server VMware View connection and security. I read some articles and found that this has been achieved by editing the locked.properties file. But when we have edited and replaced the file, users could not connect to the virtual desktop, so came back to us backwards and desktop computers worked fine.

  I found a few articles that we don't need to edit the locked.properties file in VMware view Horizon 6. If someone has done this please guide me through. Here are the details of the protocols and encryption algorithms that should be disabled

  Diffie-Hellman key

  Enable SSL v2/V3 and TLS 1.1 and 1.2

  Disable the RC4 encryption algorithm

  Select the secret of transfer (if possible)

  
  

  VMware view 6 is the connection to the server and security server.
  

  
  

  Thank you.
  

  Hello

  I implemented the following steps (from the manual):

  1. update the JCE policy files to take in charge the high-strength Cipher Suites

  You can add some cipher suites of high resistance for greater assurance, but first you must update the local_policy.jar and US_export_policy.jar files to each server instance and the security strategy for JRE 7 see connection to the server. You update these policy files by downloading the files to extend JCE (Java Cryptography) unlimited strength political jurisdiction from the Oracle Java SE download site 7.

  If you include some high-strength cipher suites in the list and you do not replace the policy files, you cannot restart the VMware view Horizon connection to the Server service.

  Policy files are located in the directory C:\Program View\Server\jre\lib\security from VMware.

  For more information on the download of the JCE unlimited strength jurisdiction policy 7 files, see the Oracle Java SE download site: http://www.oracle.com/technetwork/java/javase/downloads/index.html.

  After you update the policy files, you need to create backups of the files. If you upgrade the instance of the view connection server or security server, any changes you have made to these files can be replaced, and you may need to restore the backup files.

  2. the changes that policies of global acceptance with ADSI Edit

  • Start the ADSI utility on your computer see connection to the server.
  • In the console tree, select Connect to
  • In the selection or type a unique name text box or a naming context, type the unique name
    DC, DC = vdi is vmware, DC = int.
  • In the type or select a text field or the server box, select or type localhost: 389 or the name of a fully qualified domain (FQDN) of the server computer to connect to port 389 followed view.

  For example: localhost: 389 or mycomputer.mydomain.com:389

  • Expand the tree of the ADSI Editor, OU = properties, select OU = Global, then select OU = common in the right pane.
  • On the object CN = common, Global = UO, UO = properties, select each attribute that you want to change and enter the new list of security protocols or cipher suites.
    I used the following settings:

  EAP-ServerSSLCipherSuites: \LIST:TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256

  EAP-ServerSSLSecureProtocols_ \LIST:TLSv1.1,TLSv1.2

  It is not the highest possible, but they work with all the features of our customers.

  • Restart the service of VMware view Horizon connection server (server connection and security).

  This is not Activate secret transfer (if possible) , but other points are covered.

  If anyone can give a tip to activate the transfer secret, I would be grateful.

• VMware vs vmware view vs. horizon wdm

  Hi dear friends

  I need to know what is withholding wdm of vmware with vmware view with view horizon (features, tools and technical sheet)

  If there is this a document please show me

  They are essentially the same product, with more recent versions (which contain additional features) coming out under a slightly different name - the order you listed them is also the order of the liberation. VMware VDM has been renamed to VMware View, and when it is included in the Suite of the Horizon, it was changed to Horizon of VMware View. Why do you specifically, the licensing options?

• Several areas in the Horizon of VMware View AD

  Hi guys, I want to test creating Pools with 2 Active Directory domains. I have set up my environment as follows:

  
  

  Domain A

  
  

  1. connecting to the server

  Server 2-composer

  3-Security Server

  4 - vCenter Server

  
  

  Domain B

  1. connecting to the server

  2. created a separate account to View Composer

  For now seen Horizon 5.3.2 is fully functional on the field. But I need your help deployment pool using domain B. After you have configured the connection Server (joined to Domain B), I tried to add domain B by using view composer account by logging in to view Admin(Domain A) > Edit vCenter Server > change display composer settings > check server information (under Domain) but I'm 'Bad domain name.

  
  

  You guys please help or send me a link of approval one way of installation which is required for VMware View, so that I can deploy Pool using domain B.

  
  

  Without creating confidence, I added redirector conditional field B on the field which allow me to add domain B without "Bad domain name" pop up. But I don't know what to do next. Anyone can guide me please.

  
  

  Concerning

  Hello

  I've done below the configuration to create 2 different pools where VM is joined to 2 different domains.

  I have Domain A and domain B, having 2 confidence way configured by the AD team.

  I sent 3 win 2 k 8 Server and added to the field.-a. On a single server, I installed vCenter & composer on one server I installed the login server & the other I did the Server fall back to the existing connection server.

  In connect to server, I added vCenter & composer. I have 2 different users who have domain join rights in Domain A and domain B.

  Domain-A\abcUser

  Domain-B\xyzUser

  I added above 2 users in the view composer under domain settings. PFA.

  When creating a pool, in the comments tab customization for users of domain-A, I chose identifier of domain-A\abcUser machine Domain-A and the AD container, which is present in Domina-A place machines.

  for domain B user created another pool, and tab customization of comments, I chose domain-B\xyzuser and the AD container that belongs to the domain B to place machines.

  If you want to add a different machines, you must not deploy a connection/replica server in each domain. Just add the ID domain user under domain composer view tab and choose the right ID when creating the pool.

• Is it possible to remove the disposable disc to a pool configuration in VMware View?

  I would like to remove the option of disposable disc several persistent pools in VMware View Horizon 5.3.1 (where virtual machines are already using disposable disks); However, there doesn't seem to be a way to do this in the options of the pool. Is it possible to remove the disk otherwise option or should I remove the old pool and create a completely new without this option enabled?

  I used disposable disk option seems to be to save storage space, but I discovered that disposable disks have been updated only when displaying launched a turning off the virtual machines in the pool (which never happens). I thought that disposable records updated each time that a client shutdown/restarted the VM... but which is not the case. Given this information, I would like to stop using disposable disks as they really may not confer any advantage the way our persistent virtual machines are configured.

  Thanks in advance for any help!

  OK, you're right... only the drive letter customization is allowed.

  Now to answer your question, the one and only formally is to remove the pool by archiving all disks persistent (user data disk), and then create a pool with the same name (but without SDS).

  In addition, select all the archived UDD and then click on, "recreate". All new desktop computers will be recreated with the new spec,

  Another way (not officially committed / not sure of its effects)

  EAP-SVIVmPersistentDiskSpec entry will be there to ADAM OR = database server groups (VMware KB: connecting to the Database View ADAM)

  This entry will be there for disposable system that has a parameter "DiskUsage is SystemDisposable".

  Upron deleting the corresponding entry * may * end configuring don't not the SSD for the supply of others.

• VMware View Client Logo/skin

  We did it with other products before, but curious if we can change the skin of the Horizon of VMware View Client to something more exclusive to our society, such as our logo or by putting the name of the company in there.  We would also like to do on the Clients of zero if possible Teradici.

  Anyone done this?  I watched the local folder 'skins' under the program VMware View\Client, but these are the old skins (don't know why they are still there).

  Thanks in advance.

  I don't know if you should still do this, but I was able to achieve earlier on the VMware View client.  I discovered this by accident when I 'played '.  Within the facility there is a dll called wswc_en_us_409, it is in C:\Program VMware View\Client\bin.  You will need an application that will be able to open the dll, I think I used Microsoft Visual Studio.  In there is a bitmap (I think it's a bitmap) of the VMware View logo that appears on the client from the view.  If you create a bitmap with the same size, you should be able to replace it.  It worked on older versions of view, I do not know if it works on the latest version.

  To do this on customers of zero Teradici much easier.  In the profile on the management console, there is a parameter named profile OSD Logo which will allow you to upload an image.  You will need to set the OSD Logo to use for setting banner Login to true.

• VMware View - provisioning question of desktop computers

  I'm new to VMware View and just build a my QA cluster environment.  I have installed/configured view administrator on a dedicated virtual machine and installed/configured on my server vCenter composer.  I created a gold statue (called, joined the domain, configured custom parameters, view agent installed) and converted to a model. Then, I created a pool on my server administrator to view and added 10 desktop computers.  They have all implemented successfully, however, they all have the same computer name (same name, I named the machine of the gold statue).  The machines that appear in VMware show the naming convention that I created, but the internal computer name is the same for all. I guess that the DNS name.  also, I can have these machines added to the announcement through this process or do they need to be predefined?

  Customization = None seems to be the reason. When we customize him clone all the related machine settings are kept from the model VM, which are the name of the Machine, machine SID, the work/domain group settings, etc. That's why you see Office all the same names as those given to the model. You can create a customization specification in the CR. Instructions to create a file of customiztion specifications in vCenter can be found at:

  http://pubs.vmware.com/vsphere-4-esx-vcenter/index.jsp?topic=/com.vmware.vsphere.vmadmin.doc_41/vsp_vm_guide/deploy_vms_from_templates_and_clones/t_create_a_customization_specification_for_windows.html

  Use this technique of customization when you create the pool. Hope that helps.

• VMware View Agent 5.2.0 PCoIP over WAN fails

  Recently, I did an upgrade on VMware View VMware view horizon 5.2 4.6 square.

  After the upgrade the 4.6.0 view agent in virtual machines of my parents to view agent 5.2.0 and rebuild the office pools, external PCoIP does not work. Can I open a session in the 5.2 Client view, see the list of office pools, select a pool, the desk at work close and try to open remotely. After 1 second, this error appears:

  Error: Overview of VMware View Client: The connection to the remote computer has ended.

  What does not work:

  • External/WAN via PCoIP for workstations with the view Agent 5.2.0

  What does not work:

  • Internal/LAN via PCoIP for workstations with the view Agent 5.2.0
  • Internal/LAN via RDP for workstations with the view Agent 5.2.0
  • External/WAN via RDP for workstations with the view Agent 5.2.0
  • External/WAN via PCoIP for workstations with the Agent View 5.1.3 or lower (tested up to 4.6.0 Agent view)

  I even tried to build a new pool of desktop Windows 7 in a new OU in the active without optimizations VDI directory or group policy. I tried with and without the firewall Windows is activated. In any case, this new office pool works externally via any Agent from view but the view Agent 5.2.0.

  Is it the 5.2.0 Agent view have the same firewall/port that the Agent View 5.1.3 requirements? What else can I test or try to get external PCoIP for desktop computers to work with the view Agent 5.2.0?

  Finally, we discovered the problem / solution. We on a security apparatus of Palo Alto Networks that blocked traffic PCoIP 5.2.0 but not PCoIP 5.1.3 traffic.

  According to a backline Vmware engineer:

  "A change was made to the ephemeral TLS connection that is used to establish trust and to negotiate parameters for subsequent UDP traffic network. This change allows the customer to use their own certificate for TLS server for this connection. For more details of what happens during the installation of PCoIP, and how this changed view 5.2, see KB 1038762. »

  It seems that Palo Alto Networks did not like this change. When we removed our Palo Alto of WAN device, PCoIP 5.2.0 connections could be created. We finally had create a rule to allow the category: private-ip-addresses and URL: pcoip - by default-sni. Once this change has been made, connections WAN PCoIP 5.2.0 started working.

• Overview of VMware View PCoIP

  Hello

  We have a test lab test view VMware Horizon on a test environment however we find that the following questions.

  When is connected through the vmware view client, enter the user name and then select on the desktop, we find that the following two errors:

  he tries to connect to the desktop computer, then we get a black screen, then a prompt that shows the end of the connection to the remote computer.

  The other mistake that we get is "the Protocol to display for this office is currently unavailable, so if we click try again we get the black screen and then the same error message ended with the connection to the remote computer.

  If we choose RDP, it works.

  This configuration is configured as follows:

  (material f/w)                                      (Win7) (Windows Firewall)

  Client application VMware > > > Firewall > > > > connect to server > > > > Virtual Office

  Firewall hardware ports 443 has sent to the login server

  Hardware firewall has ports open 4172 server to connect to the virtual desktop

  Virtual office has ports open virtual desktop to connect to the server of 4172

  am I missing something?

  What we are seeing with RDP, is that she's bad performance on YouTube and by displaying the web

  Hello

  Looks like your firewall rules are not configured correctly.

  Please refer to this doc and set the rules http://communities.vmware.com/docs/DOC-14974

  Concerning

  Noble

• VMware View on Win8RT

  I think I have a Samsung ATIV Tablet and weighs checks and balances on the vs XE500 XE700, a large (the reason I'm looking for a device) is the vmware view client.

  Dows windows RT supports a version of VMware View?

  Thank you.

  The current version is a universal application (based on JavaScript) so it will install on all platforms.  The only way to get it right now is the lateral load the app by downloading and extracting the zip file from the link above on your hard drive, navigate through the folders to find the file .ps1, right-clicking and selecting run in Powershell.  If you follow all the instructions and sign in with a Microsoft Account it will allow you to side load the app.  However, you will get updates automatically by the Windows store.

  Our app currently makes its way through the Windows Store approval process, but we run into a few hiccups.  Therefore, I can't estimate when it will be published.  If you want to try it out right now I would recommend downloading and loading it.  I will update the thread when the customer is approved.  We will have a blog post on with more information on the requirements of the customer (by example fully verifiable view connection server and server certificates tunnel) when we get approval Windows Store.

• I can't install vmware view without a second server?

  I am really new to server management. When I tried to install VMware View Server connection I got an error. He said

  A controller of Active Directory (AD DC) domain to the "local" area could contacted could.

  Ensure that the domain name is typed correctly. If the name is correct, click details to correct that information.

  I also read somewhere that you can not install vmware view on the same Active Directory domain controller running server. Is it possible to install vmware view without going through a second server? If so, how?

  You may first have to install ESX/ESXi in your server.

  • After successful installation, connect to the respective client server using vShphere.
  • Try to create 3 virtual machines and install Microsoft 2 k 8 operating systems.
  • The first virtual machine, you can use it as Server Active directory micorsoft.
  • Then you can you use it to vCenter server.
  • Third one you can use for connection server vmware view.
  • You may need to create two more additional, as virtual machines VMware view comments and the other as a client of the view. You can either install windows XP/windows 7 for the VMS in the thesis.

  As already mentioned in messages, you can view VMware View Installation Guide for more details.

• Install the server Vmware View connection

  Hello

  I have problem install vmware view connection server, my server has already joined ActiveDirectory, but I can't install vmware view connection to the server

  

  Help, please.

  Thank you

  Hudan

  It simply means that the client does not like your server certificate.  You should be able to click on configure SSL and change the certification autour options to make it work.