The easiest way is to duplicate the “Computer” template and change the necessary settings. It only works with this Cryptographic Service Provider (CSP)! The computer certificate template, which is included in a standard Microsoft PKI, cannot be used! It is mandatory to use the “Microsoft Enhanced RSA and AES Cryptographic Provider” in the template. It is important to know that you have to create a new certificate template. At this point a user must use a device with a valid device certificate. Save the settings and you are ready to go. It is important to select “Device X.509 Certificate AND Passthrough”. Expand “Horizon Settings” and enter the configuration settings. Configure Horizon settings to use X.509 authenticationĪfter you have configured the X.509 authentication, you have to enable the device certificate authentication for Horizon View. This location must be accessable for the UAG! Click “Save” and you are ready to configure the Horizon settings. You can enable “Use CRL from Certificates”, if the certificates include the URL to the CRL. I always recommend to enable “Cert Revocation”. You need to upload the Root CA certificate, which is used to sign the device certificates, as a Base64 coded file. To do so, log into the UAG admin interface, expand the authentication settings and open the X.509 settings. The first step is to configure the UAG to accept a device certificate.

A certificate installed on the client device that Unified Access Gateway accepts.

To be honest: It is not so hard to get client device certificate authentication to work. At this point the arch enemy of many of us comes into play: Certificates! But what if you want to allow the login into your Horizon View environment only from specific devices? This implies that you need some kind of second factore that also identifies the device. Typically the second factor is a One-Time Password (OTP) or a push notification. This information might be outdated.Īdding a second factor to your authentication is always a good idea.

Uag vmware horizon