Starting with Parallels RAS 21.2 Update 1, the Parallels Client for Windows validates server certificates against the Windows Certificate Store in addition to the existing trusted.pem and customtrusted.pem files. This is enabled automatically after upgrading. No action is required for connectivity. When connecting to a server whose certificate is not yet trusted, users may see the following warning:
Users can choose to proceed and trust the certificate for future connections.
Symptoms
After upgrading to Parallels RAS 21.2 Update 1, the following behavior changes apply to the Parallels Client for Windows:
- Server certificates are now validated against the Windows Certificate Store in addition to
trusted.pemandcustomtrusted.pem. - A Secure Gateway certificate that previously failed validation may now succeed if its root CA is already trusted in the Windows Certificate Store.
- Enterprise root CAs deployed via Group Policy or Microsoft Intune are now automatically trusted by the Parallels Client without requiring a separate entry in
customtrusted.pem.
This change applies to the Parallels Client for Windows only. Parallels Client for macOS and Linux are not affected.
Cause
In earlier versions, the Parallels Client for Windows validated a Secure Gateway's SSL/TLS certificate only against its own bundled certificate files:
trusted.pem- certificates of common trusted authorities, shipped with the client.customtrusted.pem- certificates of custom authorities (for example, an Enterprise CA) added by the administrator.
The Windows client did not consult the certificate authorities already trusted by Windows itself.
Starting with Parallels RAS 21.2 Update 1, the Windows client additionally loads trusted root certificates from the Windows Certificate Store through the OpenSSL API when configuring its SSL context. A certificate is accepted if its root CA is trusted in any of these sources.
The table below summarizes how each certificate source is used before and after the upgrade:
| Certificate source | Before 21.2 Update 1 | After 21.2 Update 1 (Windows client) |
|---|---|---|
trusted.pem |
Used | Still used, unchanged |
customtrusted.pem |
Used | Still used, unchanged |
| Windows Certificate Store | Not used | Now used automatically |
Resolution
For most environments, no action is required - the new behavior is enabled automatically after upgrading, and existing customtrusted.pem entries remain valid.
To stay ahead of future updates, migrate any custom root certificates from customtrusted.pem to the Windows Certificate Store. This aligns with the product direction, as certificate trust management on Windows will increasingly rely on the Windows Certificate Store in future releases.
Notes for mixed-platform environments: The Windows Certificate Store is used by the Windows client only. For Parallels Client on macOS and Linux, continue adding custom root certificates to customtrusted.pem as described in the administrator's guide. On IGEL OS 12, the file is located at $HOME/.config/2X/Client/customtrusted.pem.
Adding a custom root certificate on Windows
For managed deployments, distribute the root certificate to endpoints using Active Directory Group Policy or Microsoft Intune. This is the recommended approach and avoids manual steps on each machine.
To add a certificate manually on a single machine:
- Export the root certificate from your CA in Base-64 encoded X.509 (.CER) format.
- Press Win + R, type
certlm.msc, and press Enter to open the Certificate Manager for the local machine. To install for the current user only, usecertmgr.mscinstead. - In the left pane, expand Trusted Root Certification Authorities and select Certificates.
- Right-click Certificates and choose All Tasks > Import to open the Certificate Import Wizard.
- Browse to the exported .CER file, confirm the destination store is Trusted Root Certification Authorities, and complete the wizard.
- Reconnect the Parallels Client. The Secure Gateway certificate now validates against the newly trusted root CA.
Frequently asked questions
Do I need to reconfigure anything after upgrading?
No. The Windows Certificate Store is used automatically after the upgrade, and the existing PEM files continue to be loaded.
Will my existing customtrusted.pem entries stop working?
No. The file is untouched by the upgrade and is still checked during certificate validation. Migrating to the Windows Certificate Manager is recommended but not required.
Does this affect macOS or Linux clients?
No. The change applies to the Parallels Client for Windows only.
A server certificate that failed validation before now succeeds. Why?
Its root CA is likely already trusted in the Windows Certificate Store. The client now honors that trust in addition to the PEM files.
Was this article helpful?
Tell us how we can improve it.