Using Microsoft Certreq to generate signed SSL certificates in VMware Horizon View

The Microsoft Certreq tool is available by default on a Windows Server 2008 R2 system. So a Certificate Signing Request (CSR) can be generated quickly.

Note: The preceding link was correct as of December 14, 2015. If you find the link is broken, provide feedback and a VMware employee will update the link.

Note: The tool uses a configuration file to generate a certificate request.

To create the configuration file

1. Save the request.inf file (see the Attachments section at the end of this article).
   
   In the request.inf file, you see entries similar to:
   
   ;----------------- request.inf -----------------
   [Version]
   
   Signature= $Windows NT$
   
   [NewRequest]
   
   Subject = "CN=View_Server_FQDN, OU=Organizational_Unit_Name, O=Organization_Name, L=City_Name, S=State_Name, C=Country_Name" ; replace attributes in this line using example below
   KeySpec = 1
   KeyLength = 2048
   ; Can be 2048, 4096, 8192, or 16384.
   ; Larger key sizes are more secure, but have
   ; a greater impact on performance.
   Exportable = TRUE
   FriendlyName = vdm
   MachineKeySet = TRUE
   SMIME = False
   PrivateKeyArchive = FALSE
   UserProtected = FALSE
   UseExistingKeySet = FALSE
   ProviderName = Microsoft RSA SChannel Cryptographic Provider
   ProviderType = 12
   RequestType = PKCS10
   KeyUsage = 0xa0
   
   [EnhancedKeyUsageExtension]
   
   OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
   
   [RequestAttributes]
   
   ; SAN= dns=FQDN_you_require&dns=other_FQDN_you_require 
   ;-----------------------------------------------
   
   Note: For SHA 2 or 256, add this line to cert request
   Hashalgorithm = sha256
   
   
2. Open the file using a plain text editor and apply these changes:
   
   
   • Update the Subject attributes with appropriate values.
     
     For example:
     
     Subject = "CN=view.company.com, OU=Helpdesk, O=IT, L=Palo Alto, S=California, C=US
     
     Note: Some Certificate Authorities (CAs) do not allow the use of abbreviations for the State attribute.
     
     
   • Update the KeyLength attribute if necessary. The default of 2048 is adequate unless there is a specific need for a different length.
   • If you are using a Subject Alternative Name (SAN), uncomment the line and update the SAN attribute with the FQDN.
     
     For example:
     
     server.domain.com 
     
     
3. Save and close the file.