How to change Certificate on VMware Horizon Connection Server

Learn how to manually replace the TLS certificate on VMware Horizon Connection Server, set the vdm friendly name, restart safely, and verify each pod member.

Horizon Connection Server selects its TLS certificate from the Local Computer Personal store by the exact friendly name vdm. It reads that selection when the Connection Server service starts.

The product is now sold by Omnissa rather than VMware, and its documentation lives on Omnissa's site. The name used here matches the one aethercert's deploy-target picker uses; the procedure is the same either way.

Before you begin

Obtain a PFX with a private key, Server Authentication EKU, and SANs for the individual Connection Server plus any load-balanced client name. Inventory every Connection Server, Unified Access Gateway trust or thumbprint pin, and the old vdm certificate.

Step-by-step certificate replacement

Drain one Connection Server from the load balancer.
Import the PFX into Certificates (Local Computer) > Personal > Certificates.
Remove or change the vdm friendly name on the old certificate; set the new certificate's friendly name to exactly vdm. Ensure only one eligible certificate has that name and its private key is present.
Restart the Horizon Connection Server service so it reads the new selection:
```
Restart-Service wsbroker -Force
```
Verify the node, return it to rotation, and repeat on every Connection Server in the pod. Update Unified Access Gateway proxyDestinationUrlThumbprints if the backend certificate is pinned rather than trusted through a CA.

Product-specific considerations

Do not confuse the client-facing vdm certificate with the vdm.ec certificates used for Horizon enrollment/True SSO trust. The service restart interrupts work routed through that node, so use the load balancer for a rolling change.

Verify the new certificate

Open Horizon Console against the node and load-balanced URL, inspect the certificate, then launch a desktop through Horizon Client and HTML Access. Confirm UAG health and Connection Server dashboard status.

Rollback

Restore the vdm friendly name to the old certificate, remove it from the failed new certificate, restart wsbroker, and test before returning the node to service.

Common problems

More than one certificate has friendly name vdm.
The new certificate is missing its private key or an intermediate.
vdm.ec is renamed by mistake.
UAG still pins the old backend thumbprint.
Only one pod member is updated.

Automating certificate replacement with aethercert

The aethercert Horizon target imports the certificate with friendly name vdm and restarts the local wsbroker service. Deploy it to each Connection Server separately.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.