SSL Certificates & Wyse Management Suite

In a previous post, here, I covered how to resolve the SSL error message, “SSL Certificate Authority is Unknown” when using ThinOS.

In this post I will cover how to upload SSL certificates into Wyse Management Suite (WMS) and how to assign them to a specific group configuration/profile for ThinOS 8.x and 9.x.

The process is slightly different for ThinOS 8.x & ThinOS 9.x but I will cover both below. 

How to upload SSL certificates for use by ThinOS 8.x:

1. In WMS, browse to “Apps & Data”:

2. Scroll down to “File Repository”:

3. Click “Add File” to upload Certificate:

4. Browse out to the Certificates you exported. You will need to do for each Certificate you exported.

 

5. Once you click upload it should show up under the ‘Apps & Data – Inventory File Repository”:

 

How to upload SSL certificates for use by ThinOS 9.x:

    1. In your ThinOS 9 policy, browse to “Privacy & Security\Certificates”. Here you can turn on “Auto Install Certificates” and browse to the certificates you want to upload as shown below:

 

How to assign SSL Certificates to WMS configuration group/policy: 

Once your certificates are imported into WMS, you then need to assign them to your ThinOS profile you are using under, “Groups & Configs” select the group you want to edit following steps below;

  • ThinOS 8.x: in the policy, browse to “Device Configuration\Security\General Settings”. Select “Auto-install Certificates” and your Certificate should show up in the list to select. Once you are done, click “Save & Publish”. The next time the device reboots, it will pick up the new Certificate.

  • ThinOS 9.x: in your policy, browse to “Privacy & Security\Certificates”. Here you can turn on “Auto Install Certificates” and browse to the certificates you want to upload as shown below:

This completes the process of uploading your SSL certificates to WMS and assigning them to a ThinOS policy.

For more assistance, check out Dell Community Forums (formally Dell TechCenter):

@chris_messier ~~> Subscribe to blog to get latest updates <~~

 

Dell Wyse ThinOS – “SSL Certificate Authority is Unknown”

“SSL Certificate Authority is Unknown”

A common issue connecting to a VDI connection broker, i.e Citrix, VMware, etc.., from Dell Wyse ThinOS or any thin client, is an SSL certificate error. There are generally 2 reasons why.

  • the Root Certificate Authority certificate is not installed on the device
  • the Intermediate Certificate Authority certificate is also not installed on the device

Error: SSL Certificate Authority is Unknown

This is easily fixed by installing both the missing Root and likely the Intermediate certificate.

To do this, you can simply export from a browser, and then import on the device, generally through Wyse Management Suite (WMS) or even a USB key if you had to.

I will cover the 3 step process to fix this.

  1. Export the required certificates from a browser
  2. Upload into Wyse Management Suite
  3. Assign the certificates to the device profile

Steps to export certificate from browser:

  1. In this example, I used https://portal.vmware.com as an example to work with certificates but this would be your VMware Horizon server, Citrix Storefront site, Citrix Netscaler/ADC, Microsoft Azure MFA site, etc…
  2. Click on the SSL padlock on your browser as shown below to bring up below window. Click on ‘Certificate (Valid)’ field.

3. This will bring up the certificate information:

4. Click on “Certification Path” tab bring up the following:

5. Select the top level certificate, in this case, “Sectigo (formally Comodo CA)”

6. This will bring up the Root certificate as shown below, “Comodo RSA Certification Authority”. This is the first certificate we want to export.

7. Click on the “Details” tab and select, “Copy to File”:

8. Take defaults and follow the wizard to export the certificate:

9. Once you export the top level Root Certificate, follow the same steps to export the Intermediate certificate. This Intermediate is chained, or trusted, by this top level Root Certificate so we need both certificates in this chain.

10. In the browser, select the Intermediate Certificate, “COMODO RSA Domain Validation Secure Server CA” and select “View Certificate”:

11. Select “Details” and “Copy to File” to export the certificate:

12. Follow wizard again to export the Intermediate Certificate:

13. You now have successfully exported both the top level Root Certificate, “Comodo RSA Certification Authority”, and the Intermediate Certificate, “COMODO RSA Domain Validation Secure Server CA”.

Once exported you need to upload them into your WMS server. It’s a simple process and the steps to upload the certifications are outlined here. Once complete, resume to step 15 below to assign the certificate(s) to your group configuration/profile.

15. Once certificates are imported into WMS, you then need to assign them to your ThinOS profile you are using under, “Groups & Configs” select the group you want to edit following steps below;

  • ThinOS 8.x: in the policy, browse to “Device Configuration\Security\General Settings”. Select “Auto-install Certificates” and your Certificate should show up in the list to select. Once you are done, click “Save & Publish”. The next time the device reboots, it will pick up the new Certificate.

  • ThinOS 9.x: in your policy, browse to “Privacy & Security\Certificates”. Here you can turn on “Auto Install Certificates” and browse to the certificates you want to upload as shown below:

 

This completes the process of exporting the SSL certs, uploading to WMS, and assigning them to your profile. This should resolve the issue of “SSL Certificate Authority is Unknown”.

For more assistance, check out Dell Community Forums (formally Dell TechCenter):

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Windows Virtual Desktop (WVD) & Dell Wyse Windows 10 IoT

I recently worked with a customer exploring Windows Virtual Desktop (WVD) and they asked about Dell Wyse support.

Dell was recently added to the Windows Virtual Desktop partner integration site highlighting our support with Windows 10 IoT devices, specifically our 5070, 5470 mobile thin client, & 5470 all in one thin client.

You can see more details here on the Windows Virtual Desktop partner integration page.

The Windows Virtual Desktop client is a pretty straightforward install that I’ve outlined below.

Note: You want to run the installation as an administrator and be sure to disable the File Based Write Filter before running the client install to ensure the install and changes are saved to the device.

  1. We installed this on Windows 10 IoT Enterprise 2016 LTSB
  2. Download latest WVD client from here. Note: Be sure to use the latest released WVD client as Microsoft has made note of blocking older & unsupported clients including MSTSC clients.

3. Run the installer and take the defaults for a typical installation

4. Once finished, launch the client and follow the prompts to get access to your Windows Virtual Desktop resources.

You’re finished! This outlines the basic steps to get the client installed on Windows 10 IoT Enterprise.

Look for additional Windows Virtual Desktop support on other Dell Wyse platforms in the near future!

Hope this helps someone out!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

New Updates! Cisco Jabber & Microsoft Skype for Business Enhancements for Wyse ThinOS

Cisco Jabber & Microsoft Skype for Business, and other unified communications solutions, are some of the solutions often requested in virtual desktop deployments. Citrix & VMware have both made some key advancements on the server side, i.e. Citrix HDX RealTime Optimization Pack (RTME) & VMware Horizon Virtualization Pack for Skype for Business.

Most of the client side solutions to ‘offload’ some of this processing has been focused on using Windows, or Windows Embedded, based endpoints. The request of many customers is to simplify & secure the endpoint as much as possible, which can lead to using a non-Windows based endpoint and running Windows 10/7 in the data center.

Dell Wyse just released Wyse ThinOS 8.6 which includes support for Cisco Jabber Softphone for VDI for Citrix and Skype for Business on VMware Horizon.

You can see more on these announcements here and some technical details in the Wyse ThinOS 8.6 release notes here.

Enjoy!

@chris_messier ~~> Subscribe to blog to get latest updates <~~

Just Released! What’s new with Wyse Management Suite 1.3?

Dell Releases Wyse Management Suite 1.3

The Dell Wyse team has recently released Wyse Management Suite (WMS) 1.3 and also updated the cloud hosted version at www.wysemanagementsuite.com!

You can see a quick summary of the new features below.

You can download this new WMS 1.3 and documentation from here.

New features

Wyse Management Suite – Error pulling Windows 10 IoT Image

In some recent lab testing I ran into the following error: “CCM on-prem Server authentication token is not available in configuration file.”

I got this error when attempting to pull a Windows 10 IoT Image off a Wyse 5060 client.

The fix was to push the updated Merlin package, aka boot agent, to the device prior to capturing image.

This package is already pre-loaded in the Wyse Management Suite software and listed under “Apps & Data\App Inventory\Thin Client” – MerlinPackage_Common.exe.

You will need to create and App Policy containing this package and push to the client.

  1. To create App Policy go to, Apps & Data\App Policies\Thin Client\Add Policy
  2. Complete the policy using the details below:
  3. Once policy is created, go to, “Jobs\Schedule App Policy” and create your policy similar to below:
  4. Once the policy is pushed successfully you should now be able to pull the image!

Error details:

(Status: Failed – [ERROR: CCM on-prem Server authentication token is not available in configuration file. (error code : 107).]
[ERROR STAGE: Repository validation.]
[REASON: Configuration file is missing authentication token of on prem Server.]
[SOLUTION: Make sure config file is updated with proper CCM on prem Server authentication token.]
| (107))

Hope this helps someone else down the road!

@chris_messer ~~> Subscribe to blog to get latest updates <~~

Additional support resources as noted below:

Dell TechCenter Wyse Product Support Forums – these are a great resource for getting up and running with the solutions as well as tips and tricks for troubleshooting common issues. Once you join the Dell TechCenter community you will have a variety of resources to get started!

Dell Wyse Support Site – Wyse documentation, log support incident, etc…

Available categories with forum and topic lists:

  • Wyse general forum: for discussions that, for example, span multiple categories, involve end-to-end methods, heterogeneous environments, new use cases or topics not found under the support documentation or existing discussions.
  • Wyse thin clients: includes Cloud Connect, Linux, Windows Embedded Standard, ThinOS and zero clients for Citrix, MultiPoint Server and VMware.
  • Wyse software: includes Wyse Management Suite, Wyse Device Manager, Wyse WSM and Wyse Virtualization Software

Wyse Converter for PCs Installation Steps

The following steps outline the typical installation of Wyse Converter for PCs

  1. Download a copy of Wyse Converter for PCs here
  2. Ensure the PC you wish to convert meets the minimum requirements and pre-requisites noted here
  3. You will also want to get access to the Wyse Management Suite software to have a centralized way to configure and manage your converted PC’s. You can get access to Wyse Management Suite by going here. Alternatively, you can manually configure the device using local GUI during testing.
  4. Run ‘WyseConverterforPCs.exe’ on your Windows 7 or Windows 10 PC you wish to convert. Note: By default, you will get a 45 day trial license as part of the installation.
  5. Follow the steps below for a typical installation:
    1. After installation completes and PC reboots you will be brought to the following screen:

WyseUser2

8. By default, Converter for PC will auto-logon as the locked down Standard User, ‘WyseUser’ as noted in step 4. In order to login as ‘WyseAdmin’ hold down ‘shift’ key and log off and you will be brought to Windows logon screen where you can select the user account you want to log in as.

  • default credentials
    • username: wyseadmin | password: DellCCCvdi
    • username: wyseuser | password: DellCCCvdi

9. At this point, you can begin your configuration of the Citrix client, VMware client, etc… using one of 2 methods:

10. You can access documentation Wyse Converter for PC documentation here and Wyse Management Suite documentation here.

Additional support resources as noted below:

Dell TechCenter Wyse Product Support Forums – these are a great resource for getting up and running with the solutions as well as tips and tricks for troubleshooting common issues. Once you join the Dell TechCenter community you will have a variety of resources to get started!

Dell Wyse Support Site – Wyse documentation, log support incident, etc…

Available categories with forum and topic lists:

  • Wyse general forum: for discussions that, for example, span multiple categories, involve end-to-end methods, heterogeneous environments, new use cases or topics not found under the support documentation or existing discussions.
  • Wyse thin clients: includes Cloud Connect, Linux, Windows Embedded Standard, ThinOS and zero clients for Citrix, MultiPoint Server and VMware.
  • Wyse software: includes Wyse Management Suite, Wyse Device Manager, Wyse WSM and Wyse Virtualization Software

@chris_messier ~~> Subscribe to blog to get latest updates <~~

 

Wyse Management Suite (WMS) DNS Discovery

Once you have Wyse Management Suite (WMS) installed the next step is to automatically have your devices ‘find’ and check-in into your WMS server. This is accomplished by setting up a few DNS records that include the key WMS server information. I’ve outlined the DNS records that need to be setup and steps to setup on Microsoft Server 2012.

  • Service Location (SRV) Record
    • _WMS_MGMT
    • _WMS_MQTT
  • Text (TXT) Record
    • _WMS_GROUPTOKEN
    • _WMS_CAValidation

Steps to setup Service Location (SRV) Record on Microsoft Server 2012

  1. On your DNS server navigate to the domain you want, then right click on “_tcp”, and select “Other New Records”.

  2. To setup the 2 SRV records, select “Service Location (SRV) from the options.

  3. Setup your record for, “_WMS_MGMT”. This is the FQDN of your WMS server. Use the following options below:
    1. Domain: Your domain name
    2. Service: _WMS_MGMT
    3. Protocol: _tcp
    4. Priority: 0
    5. Weight: 100
    6. Port Number: 443
    7. Host offering this service: your_wms_server, i.e. wms1.dellse.local

  4. Setup your record for, “_WMS_MQTT”. This is a service port WMS uses. This is the FQDN of your WMS server. Use the following options below:
    1. Domain: Your domain name
    2. Service: _WMS_MQTT
    3. Protocol: _tcp
    4. Priority: 0
    5. Weight: 100
    6. Port Number: 1883
    7. Host offering this service: your_wms_server, i.e. wms1.dellse.local

  5. To setup the next 2 records, navigate to the domain you want, select that node, then right click and select “Other New Records”. *Note* do not select a sub node such as _tcp for these records.

  6. Select the “Text (TXT)” Record type:

  7. Setup your record for, “_WMS_GROUPTOKEN”. This is the specific Group Token/Profile that you setup and want to use. Use the following options below:
    1. Record Name: _WMS_GROUPTOKEN
    2. Fully qualified domain name (FQDN): _WMS_GROUPTOKEN.your_domain
    3. Text: defa-labdemo1
      1. This “Text:” field is the key that you want to use. You will get this from your WMS console where you setup your group profile under the key icon.

  8. Setup your record for, “_WMS_CAValidation”. If you are not using an SSL cert (default), then this value needs to be set to ‘False’. If you are using a cert, then this would be set to “True”. Use the following options below:
    1. Record Name: _WMS_CAValidation
    2. Fully qualified domain name (FQDN): _WMS_CAValidation.your_domain
    3. Text: False (or True, if using a cert)

9. Once you have these 4 options setup, you should see the following in DNS;

The following records should be listed under your_domain:

The other 2 records should be listed under, your_domain\_tcp

10. This completes the setup. Once your device boots up and does it’s DNS lookup it will populate the proper fields on the device, in this example, Wyse ThinOS: