Difference between revisions of "Installing properly recognized public external SSL certificate on UAG"

From Notes_Wiki
m
m
Line 17: Line 17:
#:</pre>
#:</pre>
#: was accepted without any issue.  Non-working PEM Certificate was valid and formatted as per https://vdijedi.wordpress.com/2020/04/08/how-to-format-certificates-for-use-with-horizon-unified-access-gateways/  Even after adding spaces between ---END CERTIFICATE--- and  ---BEGIN CERTIFICATE--- of different certificates in certificate chain as per below links the issue was not solved.  '''Hence use of PFX for importing certificate into UAG is recommended.'''
#: was accepted without any issue.  Non-working PEM Certificate was valid and formatted as per https://vdijedi.wordpress.com/2020/04/08/how-to-format-certificates-for-use-with-horizon-unified-access-gateways/  Even after adding spaces between ---END CERTIFICATE--- and  ---BEGIN CERTIFICATE--- of different certificates in certificate chain as per below links the issue was not solved.  '''Hence use of PFX for importing certificate into UAG is recommended.'''
#: '''Note that UAG might accept certificate if chain is in wrong order Server -> CA -> Intermediate and services might start also.  But web page would be blank.  Hence it is critical to ensure that in pfx certificate chain order is Server certificate -> Intermediate -> CA.'''  Refer [[Openssl]] to validate order of certificates in pfx by converting to pem and them printing pem certificate subject and issuer.
#: Various errors seen when using PEM are described at:
#: Various errors seen when using PEM are described at:
#* https://docs.vmware.com/en/Unified-Access-Gateway/2012/uag-deploy-config/GUID-F679C363-4B4A-4148-A6B3-21079D957C71.html
#* https://docs.vmware.com/en/Unified-Access-Gateway/2012/uag-deploy-config/GUID-F679C363-4B4A-4148-A6B3-21079D957C71.html

Revision as of 06:13, 20 July 2021

<yambe:breadcrumb self="Installing properly recognized public external SSL certificate on UAG">VMWare Horizon|VMWare Horizon</yambe:breadcrumb>

Installing properly recognized public external SSL certificate on UAG

To install properly recognized public external SSL certificate in UAG use following steps:

  1. Login into UAG admin interface https://<FQDN>:9443/
  2. On the welcome page select "Configure Manually"
  3. In the General Settings > Edge Service Settings, click Show.
  4. Click the Horizon Settings gearbox icon.
  5. Validate "Connection Server URL". UAG should be able to resolve it via its DNS
  6. Validate "PCOIP External URL". This should be public IP (and not FQDN):port. (Default port 4172)
  7. Validate "Blast External URL". This can be public FQDN with port (Default port 443)
  8. Tunnel External URL. This also can be configured via FQDN
  9. For certificate installation go to "Advanced Settings" -> "TLS Server Certificate Settings"
  10. Here change the certificate from PEM to PFX and upload PFX certificate. We have encounted many different types of error with PEM file, while the same PEM when converted to PFX using: 
    openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt
    was accepted without any issue. Non-working PEM Certificate was valid and formatted as per https://vdijedi.wordpress.com/2020/04/08/how-to-format-certificates-for-use-with-horizon-unified-access-gateways/ Even after adding spaces between ---END CERTIFICATE--- and ---BEGIN CERTIFICATE--- of different certificates in certificate chain as per below links the issue was not solved. Hence use of PFX for importing certificate into UAG is recommended.
    Note that UAG might accept certificate if chain is in wrong order Server -> CA -> Intermediate and services might start also. But web page would be blank. Hence it is critical to ensure that in pfx certificate chain order is Server certificate -> Intermediate -> CA. Refer Openssl to validate order of certificates in pfx by converting to pem and them printing pem certificate subject and issuer.
    Various errors seen when using PEM are described at:


Refer:



<yambe:breadcrumb self="Installing properly recognized public external SSL certificate on UAG">VMWare Horizon|VMWare Horizon</yambe:breadcrumb>

Retrieved from "http://www.sbarjatiya.com/notes_wiki/index.php?title=Installing_properly_recognized_public_external_SSL_certificate_on_UAG&oldid=5310"