Configure FIPS with XenMobile
Federal Information Processing Standards (FIPS) mode in XenMobile supports U.S. federal government customers by using only FIPS 140-2 certified libraries for all encryption operations. Installing your XenMobile Server with FIPS mode ensures that all data for the XenMobile client and server are fully compliant with FIPS 140-2. That compliance applies to data at rest and data in transit.
Before installing a XenMobile Server in FIPS mode, complete the following prerequisites.
Use an external SQL Server 2014 for the XenMobile database. The SQL Server also must be configured for secure SSL communication. For instructions on configuring secure SSL communication to SQL Server, seeEnable Encrypted Connections to the Database Engine (SQL Server Configuration Manager).
Secure SSL communication requires that you install a trusted SSL certificate from a well-known certificate authority (CA) on your SQL Server. Be aware that SQL Server 2014 cannot accept a wildcard certificate. Citrix recommends, therefore, that you request an SSL certificate with the FQDN of the SQL Server.
Configuring FIPS mode
You can enable FIPS mode only during the initial setup of XenMobile Server. It is not possible to enable FIPS after installation is complete. Therefore, if you plan on using FIPS mode, you must install the XenMobile Server with FIPS mode from the start. Also, for XenMobile clusters, all cluster nodes must have FIPS enabled. You cannot have a mix of FIPS and non-FIPS XenMobile Servers in the same cluster.
There is aToggle FIPS modeoption in the XenMobile command-line interface that is not for production use. This option is intended for non-production, diagnostic use and is not supported on a production XenMobile Server.
在初始设置,启用FIPS mode.
Upload the root CA certificate for your SQL Server.
Specify the server name and port of your SQL Server, the credentials for logging into SQL Server, and the database name to create for XenMobile.
Note:
You can use either a SQL logon or an Active Directory account to access SQL Server, but the logon you use must have the DBcreator role.
To use an Active Directory account, enter the credentials in the format domain\username.
Once these steps are complete, proceed with the XenMobile initial setup.
To confirm that the configuration of FIPS mode is successful, log on to the XenMobile command-line interface. The phraseIn FIPS Compliant Modeappears in the logon banner.
Importing Certificates
The following procedure describes how to configure FIPS on XenMobile by importing a certificate.
SQL Prerequisites
The connection to the SQL instance from XenMobile must be secure and must be SQL Server version 2012 or SQL Server 2014. To secure the connection, seeHow to enable SSL encryption for an instance of SQL Server by using Microsoft Management Console.
如果the service does not restart properly, check the following: OpenServices.msc.
Copy the logon account information used for the SQL Server service.
Open MMC.exe on the SQL Server.
Go toFile > Add/Remove Snap-inand then double-click the certificates item to add the certificates snap-in. Select the computer account and local computer in the two pages on the wizard.
ClickOK.
ExpandCertificates (Local Computer) > Personal > Certificatesand find the imported SSL certificate.
Right-click the imported certificate (selected in the SQL Server Configuration Manager) and then click所有任务>米anage Private Keys.
UnderGroup or User names, clickAdd.
Enter the SQL service account name you copied in the earlier step.
Clear theAllow Full Controloption. By default the service account will be given both Full control and Read permissions, but it only needs to be able to read the private key.
CloseMMCand start the SQL service.
Ensure the SQL service is started correctly.
Internet Information Services (IIS) Prerequisites
Download the root certificate (base 64).
Copy the root certificate to the default site on the IIS server, C:\inetpub\wwwroot.
Check theAuthenticationcheck box for the default site.
SetAnonymoustoenabled.
Select theFailed Request Trackingrules check box.
Ensure that .cer is not blocked.
Browse to the location of the .cer in a web browser from the local server,
https://localhost/certname.cer
. The root cert text appears in the browser.如果the root cert does not appear in your web browser, ensure that ASP is enabled on the IIS server as follows.
Open Server Manager.
Navigate to the wizard inManage > Add Roles and Features.
In the server roles, expandWeb Server (IIS), expandWeb Server, expandApplication Development, and then selectASP.
ClickNextuntil the install completes.
Browse to
https://localhost/cert.cer
.For more information, seeWeb Server (IIS).
Note:
You can use the IIS instance of the CA for this procedure.
Importing the Root Certificate During Initial FIPS Configuration
When you complete the steps to configure XenMobile for the first time in the command-line console, you must complete these settings to import the root certificate. For details on the installation steps, seeInstalling XenMobile.
- Enable FIPS: Yes
- Upload Root Certificate: Yes
- Copy(c) or Import(i): i
- Enter HTTP URL to import:
https://
/cert.cer - Server:FQDN of SQL Server
- Port: 1433
- User name: Service account which can create the database (
domain\username
). - Password: The password for the service account.
- Database Name: A name of your choice.
Enable FIPS mode on mobile devices
By default, FIPS mode is disabled on mobile devices. To enable FIPS mode, go toSettings > Client Properties, edit theEnable FIPS Modeproperty, and set the value totrue. For more information, seeClient properties.