aethercert
Citrix and VMware

Automated certificate renewal for Horizon Connection Server

Horizon Connection Server picks its certificate by the friendly name vdm - and only after a service restart. The Horizon package handles both, for VMware Horizon and the same product under the Omnissa name.

Get started free Manual replacement guide
The deployment steps defined in this package's manifest.

At a glance

Package
vmware-horizon-target 3.0.0
Compatibility
Horizon Connection Server >=7.0 <9.0
Runs from
A Windows agent on the server
Mechanism
PowerShell · Service reload or restart
Authentication
Local - no remote login
Capabilities
Import certificate and keyReload serviceRemove old certificate
Deployment steps
import → restartConnectionServer → cleanup
Rollback
None
Key usage
Server authentication

What it does

The agent on the Connection Server imports the renewed certificate with the friendly name vdm, restarts the Connection Server service (wsbroker by default) so it loads the certificate, and removes the vdm tag and certificate it replaced.

The restart briefly interrupts new connections to that Connection Server; in a pod with several servers, run each deployment separately.

How it runs

  1. 01

    import

    Certificate and key are imported into the machine store with the friendly name vdm.

  2. 02

    restartConnectionServer

    The Connection Server service is restarted to load the new certificate.

  3. 03

    cleanup

    The previous certificate is removed.

What you configure

  • Connection Server service name (default wsbroker)
  • Whether the key may be exported later

Prerequisites

  • A Windows agent on each Connection Server
  • A certificate for the name clients use to reach Horizon

Limitations

  • The service restart interrupts new connections to that server briefly.
  • Unified Access Gateway appliances are not covered by this package.

Doing it by hand

The documentation has a step-by-step guide for replacing this certificate manually - useful for a first install, or to see exactly what the package automates.

Manual replacement guide

Related features

Certificate deploymentInstall renewed certificates into IIS, Exchange, NetScaler and other targets.Automated renewalRenew on schedule from ACME, AD CS or a commercial CA.

Solutions

Microsoft environmentsIIS, Exchange, RDS, SQL Server, AD FS and AD CS - automated.Private CA and AD CSAutomate certificates from AD CS, step-ca or a REST CA.

More in Citrix and VMware

Citrix NetScaler ADCUpload over NITRO, update the sslcertkey, save the config.VMware vCenter ServerReplace the Machine SSL certificate over the vSphere REST API.Citrix StoreFrontImport, update the IIS binding, verify, roll back on failure.

All integrations

Documentation

Frequently asked questions

VMware Horizon Connection Server

Does it work with Omnissa Horizon?

The package targets Horizon Connection Server versions 7 and 8, the product now sold under the Omnissa name.

Why is a restart needed?

Connection Server reads its certificate at service start. Without the restart it would keep serving the old one.

Automate VMware Horizon Connection Server

Enroll an agent, attach the package, and the next renewal installs itself.

Get started free All integrations

Community plan, no card required. Open registration - your account is ready in a few minutes.