Installing properly recognized public external SSL certificate on UAG

From Notes_Wiki

Home > VMWare platform > VMWare Horizon > Installing properly recognized public external SSL certificate on UAG

To install properly recognized public external SSL certificate in UAG use following steps:

  1. Login into UAG admin interface https://<FQDN>:9443/
  2. On the welcome page select "Configure Manually"
  3. In the General Settings > Edge Service Settings, click Show.
  4. Click the Horizon Settings gearbox icon.
  5. Validate "Connection Server URL". UAG should be able to resolve it via its DNS
  6. Validate "PCOIP External URL". This should be public IP (and not FQDN):port. (Default port 4172)
  7. Validate "Blast External URL". This can be public FQDN with port (Default port 443)
  8. Tunnel External URL. This also can be configured via FQDN
  9. For certificate installation go to "Advanced Settings" -> "TLS Server Certificate Settings"
  10. Here change the certificate from PEM to PFX and upload PFX certificate. We have encounted many different types of error with PEM file, while the same PEM when converted to PFX using: 
    openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
    was accepted without any issue. Non-working PEM Certificate was valid and formatted as per https://vdijedi.wordpress.com/2020/04/08/how-to-format-certificates-for-use-with-horizon-unified-access-gateways/ Even after adding spaces between ---END CERTIFICATE--- and ---BEGIN CERTIFICATE--- of different certificates in certificate chain as per below links the issue was not solved. Hence use of PFX for importing certificate into UAG is recommended.
    Note that UAG might accept certificate if chain is in wrong order Server -> CA -> Intermediate and services might start also. But web page would be blank. Hence it is critical to ensure that in pfx certificate chain order is Server certificate -> Intermediate -> CA. Refer Openssl to validate order of certificates in pfx by converting to pem and them printing pem certificate subject and issuer.
    Various errors seen when using PEM are described at:


Refer:



Home > VMWare platform > VMWare Horizon > Installing properly recognized public external SSL certificate on UAG

Retrieved from "http://www.sbarjatiya.com/notes_wiki/index.php?title=Installing_properly_recognized_public_external_SSL_certificate_on_UAG&oldid=5805"