certmon.de DE

RDP certificates: check, replace and enroll from your own CA

Every Windows machine issues itself a self-signed certificate for Remote Desktop. Clients can't validate it and show the familiar warning that “the identity of the remote computer cannot be verified”. If people click it away every day, they won't notice a real attack either. With a template from your own CA and one Group Policy setting, this is fixed in half an hour.

Which certificate is RDP using right now?

$ts = Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'"
$ts.SSLCertificateSHA1Hash

# Find the certificate for that thumbprint (Personal or Remote Desktop store)
Get-ChildItem Cert:\LocalMachine\My, 'Cert:\LocalMachine\Remote Desktop' |
  Where-Object Thumbprint -eq $ts.SSLCertificateSHA1Hash |
  Format-List PSParentPath, Subject, Issuer, NotAfter

If the certificate sits in the “Remote Desktop” store and subject and issuer are identical, it's the self-signed one. It is only valid for a few months and the Remote Desktop service renews it on its own before it expires – so there's no outage risk here, just the warning.

Certificates from your own CA via Group Policy

  1. Create a template: in the Certificate Templates console (certtmpl.msc), duplicate the “Computer” template, e.g. as RemoteDesktop. Under “Extensions → Application Policies”, “Server Authentication” is enough; if you want it explicit, add “Remote Desktop Authentication” with OID 1.3.6.1.4.1.311.54.1.2. Leave “Subject Name” on “Build from this Active Directory information” with DNS name.
  2. Permissions: on the “Security” tab, allow Read and Enroll for “Domain Computers” (or your own server group).
  3. Publish: in the Certification Authority console (certsrv.msc) → Certificate Templates → New → Certificate Template to Issue → RemoteDesktop.
  4. Group Policy: Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security → enable “Server authentication certificate template” and enter the template name (not the display name), here RemoteDesktop.

After gpupdate /force, the Remote Desktop service requests the certificate itself, binds it and renews it in time. Check with the command above after a few minutes whether the thumbprint has changed.

The warning only goes away if the name you connect to is in the certificate. So connect using the fully qualified name (srv01.contoso.local), not the IP address or the short name.

Assigning a certificate manually

For one-offs, such as a purchased certificate, assign the thumbprint directly:

$thumb = 'PUT_THUMBPRINT_HERE'
$ts = Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-tcp'"
Set-CimInstance -InputObject $ts -Property @{ SSLCertificateSHA1Hash = $thumb }

The certificate must be in the computer's Personal store and have a private key. The Remote Desktop service runs as “Network Service” and needs read access to that key: certlm.msc → certificate → All Tasks → Manage Private Keys → add “NETWORK SERVICE” with “Read”. Without it, the service can't use the certificate; look for events under “TerminalServices-RemoteConnectionManager” in the event log.

Careful: nobody renews manually assigned certificates for you. Put the expiry date in your calendar or switch to the Group Policy approach.

RD Gateway, Web Access and Connection Broker

In an RDS deployment, the roles have their own certificates – and those tend to expire unnoticed, because they often come from a public CA and were installed by hand. On the connection broker:

Get-RDCertificate | Format-Table Role, Subject, ExpiresOn, Level

# Install a new certificate (PFX) for a role
Set-RDCertificate -Role RDGateway -ImportPath C:\certs\rds.pfx -Password (Read-Host -AsSecureString) -Force

Repeat Set-RDCertificate for every role that uses the same certificate (RDGateway, RDWebAccess, RDRedirector, RDPublishing).

Further reading

Which other services on a server use certificates and how to find expiring ones is covered in Find expiring certificates on Windows servers.

More guides