Vmware horizon view client tunnel certificate invalid

Troubleshooting VMware Horizon View Client Tunnel Certificate Issues

====================================================================================

When attempting to establish a connection between your end-user device and an instance of VMware Horizon View, you may encounter a frustrating error message that reads: 'Tunnel certificate invalid.' This article will guide you through the process of diagnosing and resolving this issue.

Understanding Tunnel Certificates in Horizon View

------------------------------------------------

In the context of Horizon View 5.1 or later versions, tunnel certificates play an essential role in establishing secure connections between client devices and View Connection Servers (VCS). The certificate is used to validate the identity of both parties involved in the connection process.

When a client device attempts to establish a connection with a VCS instance, it first sends out a request for the server's certificate. Upon receiving this request, the VCS then responds by sending back its own unique tunnel certificate thumbprint (also known as its Subject Alternative Name or SAN). This thumbprint is used by the client device to verify that it has indeed established an encrypted connection with a legitimate and trusted VCS instance.

Common Causes of Tunnel Certificate Issues

---------------------------------------

There are several scenarios where you might encounter issues related to invalid tunnel certificates in Horizon View:

1. Missing Intermediate Device Certificates: If the intermediate device certificate is not installed on either your View Connection Server (VCS) instance or security server, then all client connections will fail because they cannot validate their connection to VCS.

2. Mismatched Certificate Thumbprints: When a client sends its own unique tunnel certificate thumbprint during initial authentication with the VCS, it expects this value to match what has been pre-configured on both sides of the network (i.e., your internal infrastructure). If these two values do not match due to any reason such as misconfiguration or corruption during transport, then clients will be unable to establish valid connections.

To resolve tunnel certificate issues in Horizon View:

1. Verify Certificate Installation: Ensure that all necessary certificates have been installed on both the client and server sides of your infrastructure.

- On Windows-based systems: Verify that you've added the root CA issuing these intermediate certs under Local Machine > Trusted Root Certificates > Intermediate Certification Authorities (ICA).

- On Linux/Unix platforms, check for existence within /etc/pki/ca-trust/.

2. Check Certificate Chain Configuration: Double-check your certificate chain configuration on both client and server sides to ensure that all necessary intermediaries are properly configured.

- Client-side: Ensure the root CA is present in the trusted roots store (e.g., Local Machine > Trusted Root Certification Authorities).

3. Verify SAN Values:

On VCS, go to 'Horizon View Connection Server' > 'View Connection Proxy Settings'.

Underneath the section labeled as 'Security', you'll see an option called 'Client certificate mapping'. Make sure that there's a checkmark next to the option which says 'Use client name from subject alternative names (SAN) attribute'.

4. Check Certificate Expiration Dates: Ensure all certificates involved in your infrastructure are not yet expired.

5. Reset Client Certificates:

On Windows: Go to Start > All Programs > VMware > Horizon View Desktops > Reset Client

Alternatively, you can also try deleting the following folders from %userprofile%/.vmware/vds/client:

- .vdsClient

- vds_client_config.dat

Then restart your client device.

6. Verify Network Connectivity:

Ensure that there are no connectivity issues between your client and server infrastructure, including any firewalls or load balancers in the path.

7. Enable Horizon View Client Log Files:

On Windows: Go to Start > All Programs > VMware > Horizon View Desktops > Options

Under 'Advanced' tab, check the box next to 'Log file'.

8. Check Event Logs for Errors

- In event viewer on your client machine under application logs look for any errors related to vmware-viewbroker or vds_client.

9. Contact VMware Support

-------

In conclusion, resolving tunnel certificate issues in Horizon View often requires a combination of careful troubleshooting and configuration verification across both the client and server sides of your infrastructure. By following these steps and ensuring that all necessary certificates are correctly installed, configured, and properly aligned on each side, you should be able to successfully establish secure connections between your end-user devices and instances of VMware Horizon View.

If despite following this guide you continue to encounter issues related to invalid tunnel certificates or other connection-related problems in Horizon View, please do not hesitate to reach out for further assistance from the VMware support team.

Vmware horizon view client tunnel certificate invalid