UCF STIG Viewer Logo

The Horizon Connection Server must force server cipher preference.


Finding ID Version Rule ID IA Controls Severity
V-246885 HRZV-7X-000004 SV-246885r768615_rule High
By default, during the initial setup of a Transport Layer Security (TLS) connection to the Horizon Connection Server, the client sends a list of supported cipher suites in order of preference. The Connection Server replies with the cipher suite it will use for communication, chosen from the client list. This is not ideal since the untrusted client is setting the boundaries and conditions for the connection to proceed. The client could potentially specify known weak cipher combinations that would make the communication more susceptible to interception. By adding the "honorClientOrder" setting to the locked.properties file, the Connection Server will reject the client preference and force the client to choose from the server ordered list of preferred ciphers.
VMware Horizon 7.13 Connection Server Security Technical Implementation Guide 2021-07-30


Check Text ( C-50317r768613_chk )
On the Horizon Connection Server, navigate to "\VMware\VMware View\Server\sslgateway\conf".

If a file named "locked.properties" does not exist in this path, confirm with the SA if forcing server-side cipher order was enforced at a global level via ADSI EDIT. If no such global change was made, this is a finding.

Open "locked.properties" in a text editor. Find the "honorClientOrder" setting. Ensure they are set as follows:


If there is no "honorClientOrder" setting, this is a finding.

If the "honorClientOrder" is not set to "false", this is a finding.
Fix Text (F-50271r768614_fix)
On the Horizon Connection Server, navigate to "\VMware\VMware View\Server\sslgateway\conf".

Open "locked.properties" in a text editor. Remove any existing "honorClientOrder" settings. Add or change the following line:


Save and close the file. Restart the "VMware Horizon View Connection Server" service for changes to take effect.