Configure SSL connections to satisfy Security Tools

Specifies how SSL session negotiation connections are established.

In order to satisfy port scanners, enable this 'Configure SSL connections' setting and on a View Agent, do the following:

1. In Microsoft Management Console, store a correctly named and signed certificate into the Personal store for the Local Machine's computer account. Make sure to mark it exportable.
2. Store the certificate for the Certificate Authority that signed it in the Trusted Root certificate store.
3. Disable connections to VMware View 5.1 and earlier.
4. Configure the agent to load certificates only from the Certificate Store. If the Personal store for the Local Machine is used, leave the certificate store names unchanged as "MY" and "ROOT" (without the quotes), unless a different store location was used in steps 1 and 2.

The resulting PCoIP Server will satisfy Security Tools such as port scanners.

Checking the box to enforce AES-256 or stronger ciphers will prevent the use of AES-128 ciphers suites during SSL negotiation.

If this 'Configure SSL connections' setting is disabled or not configured:

1. This endpoint will connect to VMware View 5.1 and earlier endpoints as well as newer ones.
2. The endpoint will use certificates from the machine account's "MY" store and Certification Authority certificates from the "ROOT" store.
3. An agent will try to load a certificate but generate a unique self-signed certificate if none is found.
4. The minimum key size will be 1024
5. The Server's certificate will be its own, not that of the View Connection Server.
6. The AES-128 cipher suite will be available.

Disable connections from VMware View 5.1 and earlier

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
Value Name	pcoip.ssl_cert_deny_legacy_connections
Value Type	REG_DWORD
Default Value	0
True Value	1
False Value	0

How a Server chooses the certificate it presents to post-VMware View 5.1 components:

0. From the Certificate Store
   

   Registry Hive	HKEY_LOCAL_MACHINE
   Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
   Value Name	pcoip.ssl_cert_type
   Value Type	REG_DWORD
   Value	1

1. Generate a unique self-signed certificate
   

   Registry Hive	HKEY_LOCAL_MACHINE
   Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
   Value Name	pcoip.ssl_cert_type
   Value Type	REG_DWORD
   Value	2

2. From the Certificate Store if possible, otherwise generate
   

   Registry Hive	HKEY_LOCAL_MACHINE
   Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
   Value Name	pcoip.ssl_cert_type
   Value Type	REG_DWORD
   Value	0

Name of the Machine account's Certificate Store to search for a certificate:

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
Value Name	pcoip.cert_store_name
Value Type	REG_SZ
Default Value	MY

The minimum keylength enforced when validating the certificate (1024, 2048 or 4096):

0. 1024
   

   Registry Hive	HKEY_LOCAL_MACHINE
   Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
   Value Name	pcoip.ssl_cert_min_key_length
   Value Type	REG_DWORD
   Value	1024

1. 2048
   

   Registry Hive	HKEY_LOCAL_MACHINE
   Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
   Value Name	pcoip.ssl_cert_min_key_length
   Value Type	REG_DWORD
   Value	2048

2. 4096
   

   Registry Hive	HKEY_LOCAL_MACHINE
   Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
   Value Name	pcoip.ssl_cert_min_key_length
   Value Type	REG_DWORD
   Value	4096

Name of the Machine account's Certificate Store to search for a Certificate Authority's certificate:

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
Value Name	pcoip.ca_cert_store_name
Value Type	REG_SZ
Default Value	ROOT

Server instructs client to request the View Connection Server's certificate

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
Value Name	pcoip.ask_clients_to_use_vcs_sni
Value Type	REG_DWORD
Default Value	0
True Value	1
False Value	0

Enforce AES-256 or stronger ciphers for SSL connection negotiation

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	Software\Policies\Teradici\PCoIP\pcoip_admin_defaults
Value Name	pcoip.ssl_disable_aes_128
Value Type	REG_DWORD
Default Value	0
True Value	1
False Value	0