← Integrations

Automated SSL certificate renewal for VMware Horizon (Omnissa)

Horizon only serves the certificate named vdm. CertKit moves the name on every renewal.

VMware Horizon, now Omnissa Horizon, picks its certificate by friendly name. Each Connection Server serves the one certificate in its Windows store named vdm, and only picks up a change when the Connection Server service restarts. The Unified Access Gateway (UAG) in front of it keeps its own Internet-facing certificate that has to be uploaded separately. A renewed certificate does nothing until someone imports it, renames it, restarts Horizon, and uploads it to every UAG. Every 47 days.

CertKit issues and renews the certificate centrally. The CertKit Agent on each Connection Server imports it, moves the vdm name, and restarts the service. The same agent uploads the Internet-facing certificate to each UAG through its REST API.

Start free trial Watch demo

Built for VMware Horizon Beta

Pre-built templates for the Horizon Connection Server and Unified Access Gateway ship in your CertKit account, currently in beta.

On a Connection Server, the agent imports the renewed certificate with a private key Horizon can read, renames the old certificate, gives the new one the vdm name, and restarts the Connection Server service with its dependent services. It reports success only when every Horizon service is running again and the server serves the new certificate.

On a UAG, the agent uploads the certificate as a PFX to the Internet interface and checks that the appliance serves it on port 443. The admin interface certificate stays as it is.

The restart takes that Connection Server out of service while Horizon comes back up. Drain it from the load balancer first, renew one server or appliance at a time, and run deployments in a maintenance window.

How to install an SSL certificate on VMware Horizon Connection Server and UAG

The manual process, if you want to do it yourself:

  1. Import the certificate with an exportable key. On the Connection Server, open the Certificates snap-in for the local computer, go to Personal → Certificates, and import the PFX. Select "Mark this key as exportable." Import any intermediates into Intermediate Certification Authorities → Certificates.
  2. Move the vdm friendly name. Open the old certificate's Properties and clear vdm from the Friendly name on the General tab. Then type vdm as the new certificate's friendly name. Only one certificate in the store can have it.
  3. Restart the Connection Server service. Restart Omnissa Horizon Connection Server (VMware Horizon Connection Server on older releases). If the Blast Secure Gateway stays Paused afterward, Horizon can't read the private key, and the Horizon Console may not load at all.
  4. Replace the UAG certificate. In the UAG admin UI, choose Configure Manually, then open TLS Server Certificate Settings under Advanced Settings. Apply it to the Internet Interface, set Certificate Type to PFX, upload the PFX with its password, and save.
  5. Check and repeat. In the Horizon Console dashboard, confirm the server no longer shows SSL Certificate: Invalid. Then repeat on every Connection Server and every UAG.

Every one of these steps is manual, and Horizon won't repeat any of them when the certificate renews. With lifetimes shrinking to 47 days, that's twelve times a year, on every Connection Server and every UAG. Miss one and Horizon Client users get certificate warnings, or remote workers can't reach their desktops at all.

At 47 days, automation is the only sustainable way to run Horizon certificates. Here's how CertKit does it.

From an operational perspective, CertKit is easy to deploy and manage. The ability to configure unique and specialized certificates is key to replacing our manual certificate processes.

Laura Thomas, Senior Central Systems Administrator, University of St. Thomas

How it works

 Your network                   CertKit                 ACME CA
┌──────────────────────────┐     ┌──────────────────┐    ┌─────────────┐
│ ┌──────────────────────┐ │     │                  │    │             │
│ │ Connection Server    │ │     │  Issue & Renew   │◄──►│             │
│ │  CertKit Agent ──────┼─┼────►│   Certificates   │    │             │
│ │  [x] vdm renamed     │ │HTTPS│                ┌───┐  └─────────────┘
│ │  [x] Restarted       │ │ out └────────────────│DNS│
│ └──────────┬───────────┘ │                      └───┘
│            │ REST :9443  │
│            ▼             │
│ ┌──────────────────────┐ │
│ │ UAG                  │ │
│ │  [x] Uploaded        │ │
│ │  [x] Serving         │ │
│ └──────────────────────┘ │
└──────────────────────────┘

CertKit issues and renews certificates centrally using delegated DNS validation. You create a one-time CNAME record, and CertKit handles every ACME challenge after that.

The CertKit Agent on each Connection Server pulls each renewal from CertKit over outbound HTTPS and changes the Windows certificate store itself. The same agent, or one on any Windows host that can reach the UAG, signs in to the UAG's management API on port 9443 and uploads the certificate. CertKit never connects into your network, and neither the UAG nor the Connection Server runs ACME or holds DNS credentials.

Two certificates, and a thumbprint that can pin them

A Horizon deployment with a UAG has two separate places where clients meet a certificate. CertKit ships a template for each.

Connection Server The certificate named vdm in the local computer's Personal store, loaded when the service starts UAG Internet interface Uploaded as PFX or PEM through the admin UI or REST API, separate from the admin interface certificate

The catch is the link between them. A UAG's Horizon Settings can pin the Connection Server URL Thumbprint. Renew the Connection Server and its thumbprint changes, so a UAG pinned to the old one stops trusting it, even though the Connection Server itself looks healthy. CertKit doesn't change UAG Horizon settings. Update the pin as part of the renewal, or drop it when the Connection Server certificate comes from a CA the UAG already trusts. Load balancers that pin backend certificates need the same check.

What CertKit handles

Setup takes about ten minutes

  1. Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit.
  2. Prepare Horizon. Connection Servers with the Connection Server service running as Local System and FIPS mode off. For each UAG, an enabled administrator account that signs in with a password.
  3. Install the CertKit Agent. One command on each Connection Server, and on one Windows host that can reach each UAG's management port. Both need .NET Framework 4.7.2 or later.
  4. Add the Horizon deployment scripts. Choose the Connection Server template and enter the DNS name clients use for that server. Add the UAG template once per appliance with its management address, credentials, and Internet-interface address.

See the full architecture →

VMware Horizon (Omnissa) deployment requirements and troubleshooting →

Questions about the beta? Talk to the engineering team →

Why "Mark this key as exportable" isn't always enough

Horizon's gateway services read the vdm private key directly, which is why Omnissa says to mark it exportable on import. Depending on how the PFX was built, Windows can store the key in a provider that allows a password-protected export but refuses the raw export the gateway asks for. The Connection Server service shows Running. The Blast Secure Gateway sits Paused, and its log shows keystoreutil.exe failing on NCryptExportKey.

CertKit imports the key into the RSA SChannel provider from Omnissa's own certificate request example and tests the raw export before it moves the vdm name. After the restart it checks every Horizon service, not just the Connection Server. If a gateway stays Paused, the old certificate goes back.

VMware Horizon is just one part of your remote access

Most organizations give remote users more than one way in, and each one has a certificate to renew. CertKit also automates Remote Desktop Services, Citrix NetScaler, and Ivanti Connect Secure, all from one account.

See all integrations

Start automating VMware Horizon certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing