Certificates for Horizon HTML Blast Agent and non-persistent desktops

Background

If you wish to have the connection server hand off an HTML5 blast connection directly to the horizon agent then there is a requirement for there to be a trusted certificate on the desktop.

When using the Connection server as a gateway this is not required.

In addition, with UAGs providing external access you need to turn the Blast gateway off. You can use a dedicated Connection server(s) for external access, but this pairing requirement was a limitation of security server that was lifted with UAG so I don’t want to deploy additional servers.

I also want to avoid using a wildcard cert if at all possible and this all needs to happen automatically of course.

Lab Setup

I’m testing in a small lab using Horizon 7.7 Connection Server, UAG 3.4 and an internal Microsoft CA. I have enabled certificate auto enrolment which is already well covered online (couple of links below).

*Ensure you configure the cert template to have an exportable key*

*Ensure you include both server and client authentication in template*

Horizon internal cert request and deploy – here

Microsoft Computer Cert Auto enrolment – here

Enable firefox\chrome to trust Microsoft CA certs – here

I am using 2 instant clones pools, with both a windows 7 sp1 (latest patches) and windows 10 (version 1809) master images.

Right, off we go.

Firstly, let’s ensure that HTML5 access is enabled in the pool settings

And ensure the blast gateway is not in play.

Now, let’s try accessing a desktop via the HTML5 client. I’m using firefox here.

Two things to note, in addition to being flagged as not secure, the connection is using the IP address of the agent. We need to use a DNS name. To change this behavior, we can alter the Horizon LDAP attribute to prefer DNS names (using ADSI edit below). The VMware document explaining this is here

After completing the change and trying again we still receive an insecure connection but this time it is using the DNS name.

The blast client is using the self-signed certificate that is generated when the agent is installed.

VMware tell us that we can change this behaviour by obtaining our trusted cert thumbprint, tweaking a registry key and restarting the blast service. https://kb.vmware.com/s/article/2088354

No problem! – I’ve already setup autoenrollment and I can do the rest with a powershell script.

## Get CA cert thumbprint

$domainname = "mydomain"
$FQDN = "$env:COMPUTERNAME.$domainname"
$Subject = "CN=$FQDN"

$thumbprint = (Get-Childitem -path cert:\LocalMachine\My | where {$_.Subject -like $Subject}).thumbprint

## Reformat Thumbprint

$regthumb = $thumbprint -replace '([0-9A-f]{2})', '$1 '

## Replace Reg Key

Set-ItemProperty -Path "HKLM:\SOFTWARE\VMware, Inc.\VMware Blast\Config" -Name SslHash -Value $regthumb

## Restart Blast Service

Restart-Service -DisplayName 'VMware Blast'

We have now established the 3 things that we need to happen.

1. Trusted Cert must be deployed to local Machine store of Desktop – auto enrolment
2. Blast Client requires a registry setting modification – powershell script
3. Blast service needs restarting – powershell script

I confirmed that this process works as expected by running the steps manually on a persistent desktop and connecting without a security prompt.

However, I need all of these tasks to occur automatically to a freshly provisioned (non-persistent) instant clone prior to a user connection from an HTML5 client. This is where I ran into a few problems and, like so many things in life, it was all down to timing.

Windows OS

My initial thought was to run the PowerShell as a Computer Logon script in a GPO. However, due to the way instant clones pools deploy, that script would not trigger as it would need to run on the master VM (which is no use here as the certificate name would be different and it is not domain joined).

Next, I tried running the script as a post optimisation task (need to copy the .ps1 onto the Master image and call the powershell script from a batch file) during deployment.

This also did not work. After some head scratching and log checking it transpired that the script was indeed running successfully (this can be confirmed by examining the log file located in c:\windows\temp\vmware). The auto enrol was also successful so why was this not working?

The auto enrol was happening after the post-sync script!

This turned me towards incorporating the certificate deploy in PowerShell to do the enrolment. However, when using windows 7 I ran into some limitations, I could not use the get-certificate commandlet but no worries I can use certutil to trigger the process too. No such issues with Windows 10 so either method can be used.

## Deploy Certificate - WIN7

certutil -pulse
sleep 5

## Deploy Certificate - WIN10

set-location -Path Cert:\LocalMachine\My

Get-Certificate -Template "Computer Auto Enroll" -Url ldap:

I also played with creating a scheduled task on the master image that triggers the script when the auto-enrolment (event ID 66) is logged and that also seems to work nicely (below) but I prefer the script solution which limits the amount of moving parts to manage.

So now we get a nice user experience logging into the desktop via the HTML5 client without using the Blast gateway.

Hopefully that was of some use and gives an understanding of the process. In summary, steps required are:

• Setup Certificate Autoenrollment with an internal CA
• Create Powershell script(s)
• Add script location to post synchronisation settings of required desktop pool
• Publish IC Pool

Complete Script is below

## Deploy Certificate - WIN7

certutil -pulse
sleep 5

## Deploy Certificate - WIN10

set-location -Path Cert:\LocalMachine\My

Get-Certificate -Template "Computer Auto Enroll" -Url ldap:

## Get CA cert thumbprint

$domainname = "mydomain"
$FQDN = "$env:COMPUTERNAME.$domainname"
$Subject = "CN=$FQDN"

$thumbprint = (Get-Childitem -path cert:\LocalMachine\My | where {$_.Subject -like $Subject}).thumbprint

## Reformat Thumbprint

$regthumb = $thumbprint -replace '([0-9A-f]{2})', '$1 '

## Replace Reg Key

Set-ItemProperty -Path "HKLM:\SOFTWARE\VMware, Inc.\VMware Blast\Config" -Name SslHash -Value $regthumb