Trusted certificate loading changes in Parallels Client for Windows - RAS 21.2 Update 1

Starting with Parallels RAS 21.2 Update 1, the Parallels Client for Windows uses the Windows Certificate Store as its primary source of trusted certificates. If the Windows Certificate Store cannot be accessed, the client falls back to the legacy trusted.pem and customtrusted.pem files. Certificates stored only in customtrusted.pem are not automatically migrated to the Windows Certificate Store during an upgrade.

When connecting to a server whose certificate is not yet trusted, users may see the following warning:

Users can choose to proceed and trust the certificate for future connections.

Symptoms

After upgrading to Parallels RAS 21.2 Update 1, the following behavior changes apply to the Parallels Client for Windows:

• Server certificates are now validated primarily against the Windows Certificate Store. If a required root certificate exists only in customtrusted.pem and has not been imported into the Windows Certificate Store, certificate trust warnings may be displayed after upgrading.

• A Secure Gateway certificate that previously failed validation may now succeed if its root CA is already trusted in the Windows Certificate Store.

• Enterprise root CAs deployed via Group Policy or Microsoft Intune are now automatically trusted by the Parallels Client without requiring a separate entry in customtrusted.pem.

This change applies to the Parallels Client for Windows only. Parallels Clients for macOS and Linux are not affected.

Cause

In earlier versions, the Parallels Client for Windows validated SSL/TLS certificates using two local certificate files:

• trusted.pem (default trusted certificate authorities shipped with the client)
• customtrusted.pem (customer-added certificate authorities that persist across upgrades)

Starting with Parallels RAS 21.1 Update 1, the Windows client uses the Windows Certificate Store as its primary source of trusted certificates.

If the Windows Certificate Store cannot be loaded, the client falls back to using trusted.pem and customtrusted.pem.

This fallback occurs only when the Windows Certificate Store itself cannot be accessed. It does not occur when a required certificate is simply missing from the Windows Certificate Store.

Resolution

Administrators using only public certificate authorities generally do not need to take any action.

Organizations that use private or enterprise certificate authorities should ensure that any custom root certificates currently stored in customtrusted.pem are imported into the Windows Certificate Store before upgrading clients.

To stay ahead of future updates, migrate any custom root certificates from customtrusted.pem to the Windows Certificate Store. This aligns with the product direction, as certificate trust management on Windows will increasingly rely on the Windows Certificate Store in future releases.

Notes for mixed-platform environments: The Windows Certificate Store is used by the Windows client only. For Parallels Client on macOS and Linux, continue adding custom root certificates to customtrusted.pem as described in the administrator's guide. On IGEL OS 12, the file is located at $HOME/.config/2X/Client/customtrusted.pem.

Adding a custom root certificate on Windows

For managed deployments, distribute the root certificate to endpoints using Active Directory Group Policy or Microsoft Intune. This is the recommended approach and avoids manual steps on each machine.

To add a certificate manually on a single machine:

1. Export the root certificate from your CA in Base-64 encoded X.509 (.CER) format.
2. Press Win + R, type certlm.msc, and press Enter to open the Certificate Manager for the local machine. To install for the current user only, use certmgr.msc instead.
3. In the left pane, expand Trusted Root Certification Authorities and select Certificates.
4. Right-click Certificates and choose All Tasks > Import to open the Certificate Import Wizard.
5. Browse to the exported .CER file, confirm the destination store is Trusted Root Certification Authorities, and complete the wizard.
6. Reconnect the Parallels Client. The Secure Gateway certificate now validates against the newly trusted root CA.

Frequently asked questions

Do I need to reconfigure anything after upgrading?

Not if all required root certificates are already trusted by Windows. If your environment relies on certificates stored only in customtrusted.pem, you should import those certificates into the Windows Certificate Store to avoid certificate trust warnings after upgrading.

Will my existing customtrusted.pem entries stop working?

The customtrusted.pem file remains available as a fallback trust source if the Windows Certificate Store cannot be used. However, when the Windows Certificate Store is available, certificate validation is performed using the Windows trust store. Certificates stored only in customtrusted.pem should therefore be migrated to the Windows Certificate Store.

Does this affect macOS or Linux clients?
No. The change applies to the Parallels Client for Windows only.

A server certificate that failed validation before now succeeds. Why?
The certificate's root CA is likely already trusted by Windows. Starting with Parallels RAS 21.1 Update 1, the Parallels Client for Windows uses the Windows Certificate Store as its primary source of trusted certificates.