Using certificates in Kaspersky Thin Client

The TLS encryption protocol ensures secure data transfer between a client and a server using SSL connection certificates. An SSL connection certificate (hereinafter referred to as an "SSL certificate" or simply "certificate") is a block of data containing information about the certificate owner, the owner's public key, and the start and end dates of certificate validity.

In Kaspersky Thin Client, certificates are used for the following purposes:

• Connecting a thin client to Kaspersky Security Center.
• Connecting to a remote environment:
  • Authentication of the Remote Desktop Connection Broker server when connecting to a remote desktop or virtual application.
  • Authentication of the broker when connecting to a remote desktop managed by Basis.WorkPlace.
  • Authentication of the server address when connecting to a remote environment in Web Access.
• Connecting to a log server.

If the user is connecting to a remote environment or to a log server in the Kaspersky Thin Client interface for the first time, and the thin client is in one of the following states:

• not connected to Kaspersky Security Center
• not added to the administration group
• no certificates for connecting to the remote environment have been added for the administration group to which the thin client belongs

then the user can independently accept or reject the certificate in the Kaspersky Thin Client interface. All accepted certificates will be saved in the thin client certificate store. In this case, a user could also connect to nodes and use certificates that are not controlled by the administrator.

We recommend configuring the Kaspersky Thin Client connection to a log server and to a remote environment only using certificates that were assigned by the administrator in the Web Console. In this case, all certificates that were previously accepted by a user will be removed from the thin client certificate store. These measures will help prevent Kaspersky Thin Client from connecting to untrusted nodes.

We advise to update the assigned certificates in the following cases:

• Current certificates have been compromised.
• Certificates have expired.
• Certificates need to be regularly updated in accordance with the information security requirements of your enterprise.

Kaspersky Thin Client does not check to see if the certificate is on the Certificate Revocation List.

Page top