VMware Horizon FLEX Administration Guide

Transcription

1 VMwre Horizon FLEX Administrtion Guide Horizon FLEX 1.1 This doument supports the version of eh produt listed nd supports ll susequent versions until the doument is repled y new edition. To hek for more reent editions of this doument, see EN

2 VMwre Horizon FLEX Administrtion Guide You n find the most up-to-dte tehnil doumenttion on the VMwre We site t: The VMwre We site lso provides the ltest produt updtes. If you hve omments out this doumenttion, sumit your feedk to: dofeedk@vmwre.om Copyright 2014, 2015 VMwre, In. All rights reserved. Copyright nd trdemrk informtion. VMwre, In Hillview Ave. Plo Alto, CA VMwre, In.

3 Contents VMwre Horizon FLEX Administrtion Guide 5 1 Introduing Horizon FLEX 7 Horizon FLEX Components 7 Horizon FLEX Arhiteture 8 Horizon FLEX System Requirements 9 Horizon FLEX Network Requirements 10 Supported Host nd Guest Operting Systems 10 2 Instlling Horizon FLEX 13 Horizon FLEX Instlltion Overview 13 Instlling nd Configuring Mirge for Horizon FLEX 14 Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges 15 Crete Virtul Diretory nd Edit Site Bindings in IIS 15 Configure Ative Diretory Settings 16 Test the Horizon FLEX Admin Console Connetion 16 Host System Requirements for Fusion Pro 17 Instll Fusion Pro on M 17 Running n Unttended Plyer Pro Instlltion 18 Creting Mss Deployment Pkge to Deploy Fusion Pro 18 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 19 Creting Trusted Certifites List 19 Using Self-Signed Certifites 22 Using Internl CA Certifites 23 4 Creting nd Deploying Horizon FLEX Virtul Mhines 27 Horizon FLEX Virtul Mhine Deployment Overview 27 Crete Soure Virtul Mhine in Fusion Pro 28 Prepre Soure Virtul Mhine to Join Domin 30 Compress Soure Virtul Mhine Pkge 30 Register Soure Virtul Mhine with the Horizon FLEX Poliy Server 31 Creting Poliies nd Entitlements 32 Crete URI to Deploy Horizon FLEX Virtul Mhine 36 Mnge Horizon FLEX Virtul Mhines 37 Index 39 VMwre, In. 3

4 VMwre Horizon FLEX Administrtion Guide 4 VMwre, In.

5 VMwre Horizon FLEX Administrtion Guide The VMwre Horizon FLEX Administrtion Guide desries how to instll nd dminister VMwre Horizon FLEX. Intended Audiene This informtion is intended for nyone who wnts to instll Horizon FLEX. The informtion is written for experiened Windows system dministrtors who re fmilir with virtul mhine tehnology. VMwre, In. 5

6 VMwre Horizon FLEX Administrtion Guide 6 VMwre, In.

7 Introduing Horizon FLEX 1 Horizon FLEX is poliy-sed, ontinerized desktop solution tht enles IT dministrtors to rete, seure, nd mnge lol desktops for end users. End users work within restrited virtul mhine, lled Horizon FLEX virtul mhine, on their own omputers. Beuse Horizon FLEX virtul mhines re stored lolly, on end-user omputers, orporte pplitions re essile to offline users. This hpter inludes the following topis: Horizon FLEX Components, on pge 7 Horizon FLEX Arhiteture, on pge 8 Horizon FLEX System Requirements, on pge 9 Horizon FLEX Network Requirements, on pge 10 Supported Host nd Guest Operting Systems, on pge 10 Horizon FLEX Components Horizon FLEX is omintion of existing VMwre produts, inluding dditionl Horizon FLEX-speifi funtionlity. VMwre Mirge for Horizon FLEX Horizon FLEX Poliy Server Horizon FLEX Admin Console The stndrd Mirge server tht provides optionl Horizon FLEX virtul mhine mngement. You n mnge, k up, nd pth virtul mhines y using the Mirge for Horizon FLEX lyering tehnology. An extension of the Mirge server tht inludes Horizon FLEX-speifi funtionlity. The Horizon FLEX Poliy Server is tivted fter you pply the Horizon FLEX liense to Mirge for Horizon FLEX. The We mngement user interfe for the Horizon FLEX Poliy Server. The Horizon FLEX Admin Console is loted in the Mirge We Mngement omponent. You n use the Horizon FLEX Admin Console to perform virtul mhine mngement tsks, inluding the following: Mnge n inventory of virtul mhines Browse list of users nd groups in the Ative Diretory servie Entitle users nd groups to one or more virtul mhines Speify virtul mhine poliies for given entitlement Prevent users from essing virtul mhines y using remote lok Exmine virtul mhine detils nd sttus t n given point in time VMwre, In. 7

8 VMwre Horizon FLEX Administrtion Guide Horizon FLEX Client Horizon FLEX Virtul Mhine The lient softwre tht end users use to downlod the Horizon FLEX virtul mhines to their lol omputers. The lients inlude VMwre Fusion Pro for M omputers nd VMwre Plyer Pro for Windows omputers. Fusion Pro nd Plyer Pro re inluded in the Horizon FLEX pkge. One liense key is provided for oth Fusion Pro nd Plyer Pro. The virtul mhine tht end users run on their own omputers. You use Fusion Pro to rete soure virtul mhines for Horizon FLEX virtul mhines. Fusion Pro is inluded in the Horizon FLEX pkge. A Horizon FLEX server n support up to 1000 users. NOTE You n lso use VMwre Worksttion to rete soure virtul mhines. Worksttion is not inluded in the Horizon FLEX pkge. Aout Mirge Mirge is integrl to the opertion nd use of Horizon FLEX virtul mhines. Horizon FLEX uses only suset of the fetures ville in Mirge. This doument does not desrie ll of the informtion pertining to Mirge. For omplete informtion out Mirge, see the Mirge doumenttion t Horizon FLEX Arhiteture A typil Horizon FLEX deployment inludes the Horizon FLEX server, file server, n HTTPS proxy, red-only domin ontroller (RODC), nd offsite nd onsite end user systems. Figure 1-1 shows the reltionships etween the mjor omponents of Horizon FLEX deployment. Figure 1 1. Smple Horizon FLEX Deployment Horizon FLEX Server Mirge Mngement Console Mirge Mngement Server File Server HTTPS Proxy Offsite Users RODC DMZ Onsite Users 8 VMwre, In.

9 Chpter 1 Introduing Horizon FLEX Horizon FLEX Server The Horizon FLEX server is omposed of the Mirge Mngement Console nd Mirge Mngement Server omponents of the Mirge system. The Horizon FLEX server provides the following funtionlity. Assigns Horizon FLEX virtul mhines to users nd groups from diretory servie Mintins reord of Horizon FLEX virtul mhines in use y individul users Enfores poliy settings to the lient Enles modifition of poliy settings for given user nd Horizon FLEX virtul mhine omintion Monitors Horizon FLEX virtul mhine sttus The Mirge Mngement Console is the grphil user interfe used for slle mintenne, mngement, nd monitoring of deployed endpoints. The Mirge We Mnger mirrors Mirge Mngement Console funtionlity. The Mirge We Mnger nd Mirge We Mngement Console ommunite y using TCP/IP ports 7080 nd The Mirge Mngement Console nd Mirge Mngement Servie ommunite y using TCP/IP port File Server A file server stores the TAR files tht ontin the soure virtul mhine files for Horizon FLEX virtul mhines. The file server is loted inside the DMZ. HTTPS Proxy RODC An HTTPS proxy enles offsite end-user systems to reh the Mirge Mngement Console. The HTTPS proxy is inside the DMZ. A RODC enles offsite end-user systems to log in to their Horizon FLEX virtul mhines fter their virtul mhines re joined to n Ative Diretory domin. A RODC is required only if you wnt to llow outside users to log in without using VPN. The RODC is inside the DMZ. Horizon FLEX System Requirements Eh produt in the Horizon FLEX pkge hs ertin system requirements. Mirge for Horizon FLEX Plyer Pro Fusion Pro The system requirements re the sme s for Mirge 5.3. See the Mirge doumenttion t Horizon FLEX 1.1 is omptile with Plyer Pro 7.1. Plyer Pro 7.1 is inluded in the Horizon FLEX 1.1 instlltion pkge. For Plyer Pro hrdwre nd softwre requirements, see the VMwre Horizon FLEX User Guide. Horizon FLEX 1.1 is omptile with Fusion Pro Fusion Pro is inluded in the Horizon FLEX 1.1 instlltion pkge. VMwre, In. 9

10 VMwre Horizon FLEX Administrtion Guide For Fusion Pro hrdwre nd softwre requirements, see Host System Requirements for Fusion Pro, on pge 17. Worksttion Horizon FLEX 1.1 is omptile with Worksttion You n use Worksttion to rete nd open soure virtul mhine, ut Worksttion nnot downlod Horizon FLEX virtul mhine. Worksttion is not inluded in the Horizon FLEX 1.1 instlltion pkge. For Worksttion hrdwre nd softwre requirements, see the Worksttion doumenttion t Horizon FLEX Network Requirements Horizon FLEX enles end users to run orporte pplitions even when they re disonneted from the network. Horizon FLEX virtul mhines re stored lolly for omplete desktop experiene tht does not require network onnetion. A network onnetion is required etween the Horizon FLEX Poliy Server nd the Horizon FLEX Client in the following irumstnes: For the initil downlod of the Horizon FLEX virtul mhine to the user's lol omputer. To register Horizon FLEX virtul mhine tht ws provided on USB devie or deployed on the user's lol omputer. To reeive Horizon FLEX virtul mhine restrition nd poliy updtes. When you register soure virtul mhine for Horizon FLEX virtul mhine, you speify downlod lotion URL for virtul mhine pkge. The downlod folder must e essile to end user omputers for end users to downlod virtul mhines. Supported Host nd Guest Operting Systems The lol omputer on whih end users use the Horizon FLEX Client must hve supported host operting system. A Horizon FLEX virtul mhine must use supported guest operting system. Supported Host Operting Systems Your end users n run the Horizon FLEX Client nd ess their Horizon FLEX virtul mhine y using physil omputer tht hs one of the following operting systems. Tle 1 1. Supported Host Operting Systems Horizon FLEX Client Supported Operting Systems Plyer Pro Windows 7 Windows 8.1 Enterprise Windows Server 2012 R2 Windows 8 Windows 8.1 Pro NOTE Plyer Pro supports only 64-it operting systems. Fusion Pro M OS X M OS X 10.9 Supported Guest Operting Systems A Horizon FLEX virtul mhine n ontin one of the following guest operting systems. Windows 7 10 VMwre, In.

11 Chpter 1 Introduing Horizon FLEX Windows 8.1 Windows XP Windows Server 2012 R2 Windows 2012 Uuntu VMwre, In. 11

12 VMwre Horizon FLEX Administrtion Guide 12 VMwre, In.

13 Instlling Horizon FLEX 2 Instlling Horizon FLEX involves instlling the Horizon FLEX server nd lient omponents, reting folders to store Horizon FLEX virtul mhines, prepring Ative Diretory, setting up ertifites, nd reting nd deploying Horizon FLEX virtul mhines. This hpter inludes the following topis: Horizon FLEX Instlltion Overview, on pge 13 Instlling nd Configuring Mirge for Horizon FLEX, on pge 14 Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15 Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge 15 Configure Ative Diretory Settings, on pge 16 Test the Horizon FLEX Admin Console Connetion, on pge 16 Host System Requirements for Fusion Pro, on pge 17 Instll Fusion Pro on M, on pge 17 Running n Unttended Plyer Pro Instlltion, on pge 18 Creting Mss Deployment Pkge to Deploy Fusion Pro, on pge 18 Horizon FLEX Instlltion Overview Horizon FLEX is omintion of existing VMwre produts, inluding Mirge, Fusion Pro, nd Plyer Pro. Instlling Horizon FLEX involves instlling eh of these produts nd performing dditionl Horizon FLEX-speifi steps. To ensure suessful Horizon FLEX deployment, you must understnd the sequene of tsks required. Before you instll Horizon FLEX, ensure tht ll of the hrdwre nd softwre requirements re met, tht you hve vlid lienses, nd tht you hve downloded the Horizon FLEX omponent instllers from the VMwre Horizon FLEX produt downlod pge. You instll Horizon FLEX in this order: 1 Instll the Mirge system. See Instlling nd Configuring Mirge for Horizon FLEX, on pge Set up ertifites for Horizon FLEX virtul mhines. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge Crete downlod folder to store your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15. VMwre, In. 13

14 VMwre Horizon FLEX Administrtion Guide 4 Add virtul diretory in IIS for your Horizon FLEX virtul mhine downlod folder nd edit site indings. See Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge (Optionl) Configure Horizon FLEX to synhronize entities in only seleted Ative Diretory orgniztionl unit (OU). See Configure Ative Diretory Settings, on pge Test the onnetion to the Horizon FLEX Admin Console. See Test the Horizon FLEX Admin Console Connetion, on pge Instll Fusion Pro on M in your network. You use Fusion Pro to rete soure virtul mhines for Horizon FLEX virtul mhines. See Instll Fusion Pro on M, on pge Crete nd deploy Horizon FLEX virtul mhines. See Chpter 4, Creting nd Deploying Horizon FLEX Virtul Mhines, on pge Instll Horizon FLEX Client on eh end-user host, or instrut end users to instll Horizon FLEX Client on their own omputers. Horizon FLEX inludes Plyer Pro for Windows hosts nd Fusion Pro for M hosts. For single-host instlltion instrutions, see the VMwre Horizon FLEX User Guide. For Windows hosts, you n run n unttended instlltion to instll Plyer Pro on severl Windows hosts without hving to respond to wizrd prompts. See Running n Unttended Plyer Pro Instlltion, on pge 18. For M hosts, you n rete mss deployment pkge to deploy Fusion Pro to ny numer of enduser Ms. See Creting Mss Deployment Pkge to Deploy Fusion Pro, on pge 18. Instlling nd Configuring Mirge for Horizon FLEX The first Horizon FLEX instlltion step is to instll nd onfigure the Mirge system. The Horizon FLEX pkge inludes the Mirge Core Softwre, Mirge Gtewy Appline Softwre, nd Mirge PowerCLI for Windows. The Mirge deployment involves numer of omponents, inluding the Mirge Mngement Server, Mirge Mngement Console, Windows Internet Informtion Servies (IIS), nd other omponents, whih you must instll in speifi order. To instll nd onfigure the Mirge system, follow the instlltion instrutions in the Mirge doumenttion t When you instll the Mirge system, you must selet ertin options to ensure tht the Horizon FLEX server opertes orretly. During Mirge server instlltion, hoose SSL for the Mirge server trnsport. SSL is required to use the Mirge Gtewy feture for externl ess nd mngement of Horizon FLEX systems. Before you instll the Mirge We Mnger, mke sure tht.net Frmework 4.0 is instlled on the server. The Mirge Mngement Server must run s user tht hs Ative Diretory red permissions. If you pln to join Horizon FLEX virtul mhines to n Ative Diretory domin, the Mirge Mngement Server must run s user tht hs domin join permissions. 14 VMwre, In.

15 Chpter 2 Instlling Horizon FLEX Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges During the Horizon FLEX virtul mhine deployment proess, you ompress your soure virtul mhine pkges into TAR (.tr) formt so tht end users n esily downlod their Horizon FLEX virtul mhines. You must rete downlod folder to store these TAR files. 1 Crete the downlod folder on the Horizon FLEX server or on nother server. The downlod folder does not need to reside on the Horizon FLEX server, ut the files it ontins must e downlodle without ny uthentition hllenge. 2 Assign permissions to the downlod folder so tht users n downlod the files tht it ontins. 3 (Optionl) Shre the downlod folder to n dministrtive group, suh s Domin Admins. This step n mke it esier to register your soure virtul mhines with the Horizon FLEX Poliy Server. Wht to do next Crete virtul diretory in IIS to llow the Horizon FLEX virtul mhines to e downloded to end-user systems. See Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge 15. Crete Virtul Diretory nd Edit Site Bindings in IIS You must rete virtul diretory in IIS to llow Horizon FLEX virtul mhine pkges to e downloded to end-user omputers. This doument does not desrie how to set up IIS for the Mirge system. For informtion out setting up IIS for the Mirge system, see the Mirge doumenttion t Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge for Horizon FLEX, on pge 14. Configure ertifite uthentition. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge 19. Crete downlod folder for your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge Open IIS Mnger. 2 Nvigte to VMwre Mirge Mngement We Site nd selet rvm. 3 Right-lik rvm nd selet Add Virtul Diretory. 4 Type nme in the Alis text ox, rowse to the folder tht you reted to ontin the Horizon FLEX virtul mhine pkges, nd lik OK. 5 Selet VMwre Mirge Mngement We Site nd lik Edit Bindings in the right olumn. 6 Set the HTTPS port to use your Horizon FLEX server ertifite nd lik OK. VMwre, In. 15

16 VMwre Horizon FLEX Administrtion Guide Configure Ative Diretory Settings When you entitle Horizon FLEX virtul mhine, you dd users nd groups from your existing Ative Diretory infrstruture to the entitlement. By defult, Horizon FLEX synhronizes your entire Ative Diretory infrstruture into the Horizon FLEX dtse. You n optionlly onfigure Horizon FLEX to synhronize only speifi OU. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge for Horizon FLEX, on pge Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 In the Horizon FLEX Admin Console, lik the Generl System Settings ion nd lik Ative Diretory Settings. 3 Type the OU to synhronize in the Orgniztionl Unit text ox. As you egin to type in the text ox, the ville OUs in your Ative Diretory infrstruture pper in drop-down menu nd you n selet the pproprite OU. 4 Clik OK to sve the OU setting. The Horizon FLEX server vlidtes the OU to mke sure it exists nd is essile. The Horizon FLEX server synhronizes the Ative Diretory entities tht elong only to the OU tht you seleted, inluding entities tht elong to ny hild OUs of the seleted OU. Any time you onfigure new OU, the Horizon FLEX server deletes the previously synhronized entities from the dtse nd strts new full synhroniztion proess. Test the Horizon FLEX Admin Console Connetion You n verify your Horizon FLEX deployment y testing the Horizon FLEX Admin Console onnetion. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge for Horizon FLEX, on pge 14. Configure ertifite uthentition. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 16 VMwre, In.

17 Chpter 2 Instlling Horizon FLEX 2 Verify tht the Horizon FLEX Admin Console pge ppers orretly. The Imges, Poliies, Entitlements, nd Virtul Mhines uttons should e visile in the left nvigtion pnel. Host System Requirements for Fusion Pro The physil omputer on whih you instll Fusion Pro is lled the host system nd its operting system is lled the host operting system. To run Fusion Pro, the host system nd the host operting system must meet speifi hrdwre nd softwre requirements. Proessor Requirements for Host Systems You n instll Fusion Pro on ny M tht hs 64-it Intel proessor. Fusion Pro is omptile with Core 2 Duo, Xeon, i3, i5, i7, nd newer proessors. Memory Requirements for Host Systems The host system must hve enough memory to run M OS X, the guest operting systems tht run inside the virtul mhines on the M, nd the pplitions tht run in the M nd guest operting systems. The minimum memory required on the host system is 4GB. 8GB is reommended. The host system must hve 750MB of free disk spe for Fusion Pro nd t lest 5GB of free disk spe for eh virtul mhine Supported Host Operting Systems To instll Fusion Pro, your M must hve supported M OS X operting system. M OS X 10.9 M OS X Instll Fusion Pro on M You instll Fusion Pro in the sme wy you instll other M OS X pplitions. Prerequisites Verify tht your M meets the system requirements for Fusion Pro. See Host System Requirements for Fusion Pro, on pge 17. Verify tht you hve the dministrtor pssword for your M. Downlod the Fusion Pro instller to your M. You n otin the Fusion Pro instller from the VMwre wesite. Verify tht you hve Horizon FLEX liense key for Fusion Pro. You must provide Horizon FLEX liense key during instlltion to tive the Horizon FLEX fetures in Fusion Pro. 1 Doule-lik the VMwre Fusion.dmg file to open it. The ontents of the disk imge pper in the VMwre Fusion Finder window. 2 In the VMwre Fusion Finder window, doule-lik the VMwre Fusion ion or drg it to the Applitions folder. 3 Clik the VMwre Fusion ion in the Applitions folder. 4 Type the dministrtor-level user redentils for your M to omplete the instlltion. VMwre, In. 17

18 VMwre Horizon FLEX Administrtion Guide 5 Aept the liense greement nd enter your Horizon FLEX liense key. Running n Unttended Plyer Pro Instlltion You n use the unttended instlltion feture of the Mirosoft Windows Instller (MSI) to instll Plyer Pro on severl Windows hosts without hving to respond to wizrd prompts. This feture is onvenient in lrge enterprise. Running n unttended instlltion of Plyer Pro is similr to running n unttended instlltion of VMwre Worksttion. For more informtion, see the VMwre Worksttion doumenttion t Creting Mss Deployment Pkge to Deploy Fusion Pro You n rete Fusion mss deployment pkge to instll Fusion Pro on ny numer of end-user Ms. You n use stndrd pkge deployment tools, inluding Apple Remote Desktop Admin, to deploy the mss deployment pkge. When you onfigure the mss deployment pkge, speify your Horizon FLEX liense key in [Volume Liense] setion of the Deploy.ini file nd ple opy of the Fusion Pro pplition to the 00Fusion_Deployment_Items folder. You n use the optionl onnetatstrtupurl prmeter in the [Lotions] setion of the Deploy.ini file to speify user nme nd the hostnme of your Horizon FLEX server, for exmple: onnetatstrtupurl = vmwre-rvm://johndoe@yourflexserver.om:7443 If there re no virtul mhines instlled on the user's M when the user lunhes Fusion Pro, the Connet dilog ox opens nd the Server nd Usernme text oxes re prepopulted with the hostnme nd user nme tht you speified in the onnetatstrtupurl prmeter. For step-y-step informtion out reting mss deployment pkge, see VMwre KB rtile : Creting VMwre Fusion mss deployment pkge. 18 VMwre, In.

19 Setting Up Certifites for 3 Horizon FLEX Virtul Mhines Before you rete nd deploy Horizon FLEX virtul mhines, you must set up ertifites to ensure tht end users n suessfully downlod nd use their virtul mhines. VMwre reommends tht you use ertifite tht is issued y ertifite uthority (CA), suh s Entrust or Go Dddy, or third-prty ertifite, on your Horizon FLEX server. If you re using self-signed ertifite or ertifite from n internl CA insted of generlly trusted ertifite, you must tke steps to ensure tht the ertifite is trusted on ll end-user omputers tht will downlod nd use Horizon FLEX virtul mhines. This doument does not desrie how to set up ertifites in Mirge. For informtion out setting up ertifites in Mirge, see the Mirge doumenttion t This hpter inludes the following topis: Creting Trusted Certifites List, on pge 19 Using Self-Signed Certifites, on pge 22 Using Internl CA Certifites, on pge 23 Creting Trusted Certifites List You n rete list of trusted ertifites for Horizon FLEX virtul mhines nd import the list to the Horizon FLEX Poliy Server. When you use trusted ertifites list, you do not need to instll ertifites on end-user hosts. Using list of trusted ertifites n prevent mliious users from reting their own self-signed ertifites for the sme hostnme nd dding those ertifites to their host's list of trusted ertifites. When you onfigure the Horizon FLEX Poliy Server to use trusted ertifites list, the server ignores the host's list of ertifites nd uses the trusted ertifites list to verify server onnetions insted. If the Horizon FLEX Poliy Server nnot verify ertifite y using the trusted ertifites list, the server onnetion fils. If the trusted ertifites list is empty in the soure virtul mhine, Plyer Pro nd Fusion Pro uthentite ginst the host's list of trusted ertifites. To rete the trusted ertifites list, you export eh ertifite to seprte file nd then ontente ll of the files into single file. You use the Horizon FLEX Admin Console to import the ontented ertifites file to the Horizon FLEX Poliy Server. You must export ertifites in Privy Enhned Mil (PEM) formt. On Windows systems, the PEM ertifite enoding is lled Bse-64 enoded X.509 (.CER). Only PEM-enoded ertifites re supported. No other ertifite formt (DER, Serilized Certifite Store/SST, PKCS #12/PFX, PKCS #7/P7B) is epted. VMwre, In. 19

20 VMwre Horizon FLEX Administrtion Guide Aout the PEM Formt The PEM formt is stndrd ertifite formt tht is Bse64 enoded. An exmple of PEM-formt ertifite is s follows: -----BEGIN CERTIFICATE----- MIIDojCCAwugAwIBAgIJAMLM0CJRzPyzMA0GCSqGSI3DQEBBQUAMIGTMQswCQYD VQQGEwJVUzETMBEGA1UECBMKQ2FsWZvm5pYTESMBAGA1UEBxMJUGFsyBBHRv MS8wLQYDVQQKEyZWTXdhmUsIEluYy4gLSBX3Jr3RhdGlviBTU0wgVGVzdGlu ZzEqMCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5MB4X DTExMDxNTAyMjY0OFoXDTE1MDxNDAyMjY0OFowgZMxCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ymlhMRIwEAYDVQQHEwlQYWxvIEFsdG8xLzAtBgNVBAoT JlZNd2FyZSwgSW5jLiAtIFdvmtzdGF0W9uIFNTTCBUZXN0W5nMSowKAYDVQQD EyFX3Jr3RhdGlviBDZXJ0WZpY2F0ZSBBdXRo3JpdHkwgZ8wDQYJKoZIhvN AQEBBQADgY0AMIGJAoGBAL/tBlngiEkCK7ssCBe8lZ30FlIHmpECmwEm3AID1C0 ln+ldrt2ammqiknxbpxgbgyrnrnnshrzp1xxr/wl22ayt7nx+p/xsh2srd GGCTN/wh/ArirTLCjRwY55lAAH9xwzortRYR84IBJQpHzxopTSI9o4ZVIqx AgMBAAGjgfswgfgwHQYDVR0OBBYEFMoT527dtvlgR1EzYK4EnQHS6T2ZMIHIBgNV HSMEgAwg2AFMoT527dtvlgR1EzYK4EnQHS6T2ZoYGZpIGWMIGTMQswCQYDVQQG EwJVUzETMBEGA1UECBMKQ2FsWZvm5pYTESMBAGA1UEBxMJUGFsyBBHRvMS8w LQYDVQQKEyZWTXdhmUsIEluYy4gLSBX3Jr3RhdGlviBTU0wgVGVzdGluZzEq MCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5ggkAwszQ IlHM/LMwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQBoiwDWGWXzI+j 0gG/7BNzpNHzR1RGAF4nB9JrnCYWvB313kgYDMHogfiAoQhsu/py/OYBYVRjjFJ YVTJ7DVl/3Gpk3+tdJfEmqIz76PVWfWTnhuJEMYrMM4W06B/K2s24kZtXQ h84fytvcg/l6tp5swgei4vwgrfxga== -----END CERTIFICATE----- When you rete trusted ertifites list, you ontente multiple PEM-formt ertifites into single file. Line endings re uto-deteted. The following exmple shows the formt of ontented ertifites list tht ontins two ertifites BEGIN CERTIFICATE----- <se64 ontent here> -----END CERTIFICATE BEGIN CERTIFICATE----- <se64 ontent here> -----END CERTIFICATE----- Crete PEM-Formt Certifites You n rete PEM-formt ertifites y downloding the ertifite from the CA's We site or y exporting the ertifites from host system. For exmple, you n downlod ertifites for Verisign from the Symnte We site t Export PEM-Formt Certifite From M You n export PEM-formt ertifite from M. Prerequisites Beome fmilir with how to use Keyhin Aess on M. For more informtion, see the Apple Support We site t 20 VMwre, In.

21 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 1 On the M, open Keyhin Aess. 2 From the sider, selet System Roots. 3 Lote the ertifite to export. 4 Selet File > Export Items. 5 Selet lotion to sve the ertifite nd selet the Privy Enhned Mil (.pem) file formt. Export PEM-Formt Certifite From Windows System You n export PEM-formt ertifite from Windows system. On Windows, the PEM ertifite enoding is lled Bse-64 enoded X.509 (.CER). Prerequisites Beome fmilir with how to use Certifite Mnger on Windows system. For more informtion, see the Mirosoft TehNet We site t 1 On the Windows system, open Certifite Mnger (ertmgr.exe). 2 Right-lik the ertifite to export nd selet All Tsks > Export. 3 Selet options in the Certifite Export Wizrd. Deide if you will export the privte key with the ertifite. Selet Bse-64 enoded X.509 (.CER) for the file export formt. For the ertifite to work with Horizon FLEX, you must hoose this option. d Provide lotion to sve the ertifite nd file nme. Review the settings you seleted nd lik Finish. The ertifite file is sved to the lotion you indited. Crete nd Import the Trusted Certifites List File After you export your PEM-formt ertifites, you must onstrut the trusted ertifite list nd import the ertifites list file to the Horizon FLEX Poliy Server. Prerequisites Export eh ertifite in PEM formt. See Crete PEM-Formt Certifites, on pge To rete the trusted ertifites list file, ontente eh PEM-formt ertifite file into single file. You n use the t ommnd, or you n opy nd pste the ontents of the ertifite files into text file. You n sfely edit Bse64 ontent in text editor. For exmple: $ t myert1.pem myert2.pem myert3.pem > list.pem 2 Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. VMwre, In. 21

22 VMwre Horizon FLEX Administrtion Guide 3 In the Horizon FLEX Admin Console, lik the Generl System Settings ion nd selet Certifites. 4 Clik Import, rowse to the trusted ertifites list file, nd lik Open to import the file. Updting Certifites on the Server When ertifite expires, nd new ertifite hs n expirtion dte tht is set fr into the future, you n dd the new ertifite s seond ertifite to the trusted ertifites list in the Horizon FLEX Poliy Server. Adding the new ertifite to the trusted ertifites list enles ll Horizon FLEX virtul mhines to downlod the new ertifite. Then, when the ertifite swith ours, ll of the Horizon FLEX virtul mhines tht reeived the new list of ertifites n onnet to the Horizon FLEX server nd you n remove the old trusted ertifite from the poliy file. Using Self-Signed Certifites If you do not onfigure the self-signed ertifite into the soure virtul mhine eing prepred, you must instll the ertifite on eh end-user host for Horizon FLEX virtul mhines to funtion orretly. If the list of ertifites is empty in the poliy file, Plyer Pro nd Fusion Pro will fll k to uthentiting ginst the host's list of trusted ertifites. If you inlude the self-signed ertifite of soure virtul mhine on the Horizon FLEX Poliy Server, nd you onfigure or instll the self-signed ertifite for the Horizon FLEX Client (either in the soure virtul mhine's poliy file or in the host's list of trusted ertifites), you do not need to instll the ertifite on end-user hosts when ertifite updtes re required, for exmple, when ertifite expires. For informtion out onfiguring ertifites into soure virtul mhine, see Crete Soure Virtul Mhine in Fusion Pro, on pge 28. For informtion out reting trusted ertifites list nd importing it to the Horizon FLEX Poliy Server, see Creting Trusted Certifites List, on pge 19. For informtion out updting ertifites, see Updting Certifites on the Server, on pge 22. Instll Self-Signed Certifite on Windows Computer To instll self-signed ertifite on Windows host, you export the ertifite from your Horizon FLEX server nd import it to the Windows omputer. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t 1 Export the self-signed ertifite from your Horizon FLEX server. On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the self-signed ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the self-signed ertifite to the Windows omputer. 22 VMwre, In.