Troubleshooting: VMware Horizon Authentication Issues (Certificate Revocation List)

Newer versions of VMware Horizon Client for Linux attempt to download a Certificate Revocation List (CRL) for any certificates used to connect to a VMware Horizon environment. Sometimes, this can cause a problem on lower-powered devices or on devices that do not have access to a CRL address.

The following article explains how to disable the CRL download if you have problems with authentication for VMware Horizon sessions in IGEL OS.

Problem

You face the following issues:

• The VMware Horizon Client "hangs" during authentication.
  OR

• The VMware Horizon Client takes a long time to authenticate (in some cases, over 1 minute).
  OR

• You are using a certificate issued by the domain's CA (certificate authority) and get the following error message:
  "Failed to connect to the connection server. The server provided an invalid certificate. Unsupported URI in CRL distribution points extension, only http/https are supported."

Solution

These issues usually occur due to the default setting for CRL download for the VMware Client for Linux. If you experience the above issues, it is recommended to disable downloading of the CRL.

To disable the download of the CRL, proceed as follows:

1. In IGEL Setup or in the configuration dialog in the UMS, go to System > Registry.
   

2. Enable the registry key vmware.view.skip-crl-revocation-check, i.e. Skip download of the certificate revocation list (CRL).

   

3. Apply the settings. If you have created a profile, assign the profile to the required devices.
   

4. Reboot the devices and test the connection again.