Enabling TLS 1.0 for VMware Horizon View 6.2.1 to allow Horizon View 3.3 or older clients to connect

Problem

As a follow up to one of my previous posts:

Upgrading from VMware Horizon View 6.0.1 to 6.2.1 causes connections to throw the error: “Unable to connect to desktop: There is no available gateway for the display protocol. Try again, or contact your administrator if this problem persists.”
https://blog.terenceluk.com/2016/01/upgrading-from-vmware-horizon-view-601.html

I finally got a chance to take some time to test the following KB that outlines the steps required to enable TLS 1.0 for backward compatibility with VMware Horizon View 6.2.0 and earlier:

Configure security protocols for PCoIP for Horizon 6 version 6.2 and later, and Horizon Client 3.5 and later (2130798)
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2130798

To provide a bit of background for the issue, let me reference the release notes found at the following URL that describes the TLS changes to PCoIP connections:

Release Notes for VMware Horizon 6 version 6.2.1
https://pubs.vmware.com/Release_Notes/en/horizon-6-view/horizon-621-view-release-notes.html

What’s New in This Release of Horizon 6

• VMware Horizon View 6.2.1 is a maintenance release. Some known issues from previous releases are resolved. For more information, see Resolved Issues.
• To improve security, SSLv3 is no longer supported. By default, TLS 1.1 and TLS 1.2 are enabled. TLS 1.0 is enabled for outgoing connections to support vSphere 5.x, but is disabled for incoming connections. If the vSphere version is 6.x, it is recommended that TLS 1.0 be disabled for outgoing connections.
• For PCoIP connections, by default, TLS 1.1 and TLS 1.2 are enabled and TLS 1.0 is disabled. Horizon Client 3.3 and earlier versions use only TLS 1.0 for PCoIP. View Agent versions earlier than 6.2 also use only TLS 1.0. To support Horizon Client 3.3 and earlier versions, as well as View Agent 6.1.x and earlier versions, if you use the PCoIP Secure Gateway, you can enable TLS 1.0 for PCoIP connections by following the instructions in KB 2130798, Configure security protocols for PCoIP for Horizon 6 version 6.2 and later, and Horizon Client 3.5 and later.
• For Blast Secure Gateway and the HTML Access agent, by default, TLS 1.1 and TLS 1.2 are enabled and TLS 1.0 is disabled. You can configure the security protocols and cipher suites for both components. See Configuring Security Protocols and Cipher Suites for Blast Secure Gateway in the View Security document and Configure Security Protocols and Cipher Suites for HTML Access Agent in the Horizon Client and View Agent Security document.
• Linux desktops now support clipboard redirection, single sign-on, and smart card redirection. The Setting Up Horizon 6 for Linux Desktops guide also documents additional bulk-deployment scripts.

The text highlighted in red are the changes to TLS that could potentially cause connectivity issues between older VMware View or Horizon View clients due to TLS 1.0 being disabled.

Testing Environment

With the background of the issue described let me begin by listing the details of the environment I used for testing:

Horizon View Connection Servers: 2 (1 for external connections and 1 for internal connections)
Horizon View Connection Server Version: 6.2.1-3284346
Horizon View Security Server Version: 6.2.1-3284346
Horizon View Agent: 6.2.1-3284346

Internal Connection Tests – Use PCoIP Secure Gateway for PCoIP connects to machine is Disabled

The View Connection server currently has the following settings configured:

Use secure Tunnel connection to machine: disabled

Use PCoIP Secure Gateway for PCoIP connections to machine: disabled

Use Blast Secure Gateway for HTML access to machine: disabled

Attempting to access this environment with one of the Wyse Windows Embedded thin clients with an unsupported Horizon Client 3.1.0 build-2085634:

… will display a blackscreen for a few seconds then disconnect with the following error:

The connection to the remote computer ended.

As per the KB article mentioned above:

Configure security protocols for PCoIP for Horizon 6 version 6.2 and later, and Horizon Client 3.5 and later (2130798)
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2130798

I proceeded to add the following registry key to my virtual desktop with the 6.2.1 agent in a pool:

HKLMSoftwareTeradiciPCoIPpcoip_admin
Name: pcoip.ssl_protocol
Type: REG_SZ
Value: TLS1.0:TLS1.1:TLS1.2

The registry can either be manually added or the following command can be executed:

reg add “HKLMSoftwareTeradiciPCoIPpcoip_admin” /v “pcoip.ssl_protocol” /t REG_SZ /d TLS1.0:TLS1.1:TLS1.2 /f

From here, connections to the virtual desktop with the unsupported Horizon Client 3.1.0 build-2085634 completes successfully without any errors.

Internal Connection Tests – Use PCoIP Secure Gateway for PCoIP connects to machine is Enabled

Changing the View Connection server’s settings to:

Use secure Tunnel connection to machine: enabled

Use PCoIP Secure Gateway for PCoIP connections to machine: enabled

Use Blast Secure Gateway for HTML access to machine: disabled

… with the registry added and then attempting to connect to the virtual desktop with the unsupported Horizon Client 3.1.0 build-2085634 fails with the error:

The connection to the remote computer ended.

Proceeding to add the following registry key to the view connection server:

HKLMSoftwareTeradiciSecurityGateway
Name: SSLProtocol
Type: REG_SZ
Value: tls1.2:tls1.1:tls1.0

… either via:

reg add “HKLMSoftwareTeradiciSecurityGateway” /v “SSLProtocol” /t REG_SZ /d tls1.2:tls1.1:tls1.0 /f

… or manually via the registry editor:

Then attempting to connect to the virtual desktop with the unsupported Horizon Client 3.1.0 build-2085634 fails with the same error message.

Note that I tried multiple troubleshooting steps but was unable to get internal View Horizon Clients that were older than 3.3 to successfully connect.

External Connection Tests

Logging onto the VMware Horizon View Security server and adding the registry key:

HKLMSoftwareTeradiciSecurityGateway
Name: SSLProtocol
Type: REG_SZ
Value: tls1.2:tls1.1:tls1.0

… either manually through the regisry editor or via:

reg add “HKLMSoftwareTeradiciSecurityGateway” /v “SSLProtocol” /t REG_SZ /d tls1.2:tls1.1:tls1.0 /f

… allows me to connect successfully connect with an unsupported Horizon Client 3.1.0 build-2085634.  However, attempting to connect with an even older View Client 5.0.0 build-481677:

… will through the following error:

The View Connection Server connection failed. A security error occurred.

It’s worth noting that I did not add the registry key to the View Connection server that was paired with the View Security server as it did not appear to matter.

Conclusion

The conclusion from my tests is as follows:

1. I was able to use the registry entry to provide access to View Connection Server 6.2.1 and View Agent 6.2.1 from an unsupported TLS 1.0 client if I am not using PCoIP Secure Gateway for PCoIP connections to the machine meaning your View client is just being brokered directly to virtual desktop
2. I was unable to use the registry entry to provide access to View Connection Server 6.2.1 and View Agent 6.2.1 from an unsupported TLS 1.0 client if I am using PCoIP Secure Gateway for PCoIP connections to the machine meaning your View client actually traverses through the View Connection server in order to connect to the virtual desktop
3. I was able to use the registry entry to provide access external access through the View Security Server 6.2.1 and View Agent 6.2.1 from an unsupported TLS 1.0 client by adding the registry entry on the Security server and View agent

What had me stumped at the end of this test was why I could not get #2 to work so comments on what I did incorrectly are welcomed.

I hope this helps anyone who may come across this issue.