Parallels Client Configuration

When using a certificate issued by an Enterprise Certification Authority (CA) or another private Root CA, the Root CA certificate must be trusted by the Parallels Client to prevent certificate trust warnings and enable secure SSL/TLS connections.

Parallels Client for Windows

Starting with Parallels RAS 21.1 Update 1, Parallels Client for Windows uses the Microsoft Windows Certificate Store as its primary source of trusted certificates.

Attention: Prior versions of Parallels Client for Windows used the trusted.pem and customtrusted.pem files for certificate validation. Starting with Parallels RAS 21.1 Update 1, Parallels Client uses the Windows Certificate Store as its primary source of trusted certificates.

Certificates that exist only in customtrusted.pem are not automatically imported into the Windows Certificate Store during an upgrade. To avoid certificate trust warnings, import any required custom Root CA certificates into the Windows Certificate Store before upgrading.

The trusted.pem and customtrusted.pem files remain available as a fallback mechanism only if the Windows Certificate Store cannot be accessed. This fallback mechanism is not used when a required certificate is missing from the Windows Certificate Store.

If the Root CA certificate is already trusted by Windows, no additional Parallels Client configuration is required.

Root certificates distributed through Active Directory Group Policy, Microsoft Intune, or other Windows certificate management mechanisms are automatically trusted by Parallels Client.

Adding a Custom Root Certificate Manually

If the required Root CA certificate is not present in the Windows Certificate Store, import it into the appropriate Windows trusted certificate store.

1. Export the Root CA certificate in Base-64 encoded X.509 (.CER) format.

2. Press Win + R and to open the Windows Certificate Manager and do one of the following:

   • Enter certlm.msc to manage certificates for the local computer, or

   • Enter certmgr.msc to manage certificates for the current user.

3. Expand Trusted Root Certification Authorities and select Certificates.

4. Right-click on Certificates and select All Tasks > Import.

5. Complete the Certificate Import Wizard:

   1. Select the exported .CER file.

   2. Choose Trusted Root Certification Authorities as the destination store.

   3. Finish the wizard.

6. Reconnect the Parallels Client.

The Secure Gateway certificate should now be validated successfully.

Parallels Client for Linux

IGEL OS 12

1. Open the following file: $HOME/.config/2X/Client/customtrusted.pem

2. If the file does not exist, create it.

3. Paste the exported certificate content into the file.

4. If other certificates are already present, append the new certificate to the end of the file.

Other Linux distributions

1. Locate the trusted.pem file, typically found in: <installation directory>/share/<installation>

2. Open the customtrusted.pem file in the same location. If the file does not exist, create it.

3. Paste the exported certificate contents into the file.

4. If other certificates are already present, append the new certificate to the end of the file.

After customtrusted.pem is created, Parallels Client verifies that the root CA exists in either trusted.pem or customtrusted.pem.

Parallels Client for macOS

Parallels Client for macOS relies on the operating system's trusted certificate authorities. Add the root certificate to the macOS trust store using the standard macOS certificate management tools.