Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to harden our RDP service so we can use a specific server without having to VPN into our network. I would like the RDP Session Host Server to use certificates from an authorized certificate authority like Verisign or RapidSSL. I can't seem to find any good tutorials covering this, if it's even possible. Right now we use the default self-signed certificate provided. When I choose 'Select', only the default self-signed cert is displayed. No other options. I'm not quite sure how to add our CA cert from our official cert authority. Is there a way change configure this for a 3rd party CA Cert?

enter image description here

Also, for encryption level, is it more secure to set this to high or FIPS compliant? If you think it's unwise to expose the RDP service, please share.

Any info is greatly appreciated.

Thanks!

I guess I should add this server is also a member of an Active Directory Domain.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You should expose only your RD Gateway (port 443) to the internet, not the session host.

enter image description here

To import new certificates for RDS to use, you need to import/install them first into the certificate store.

You might want to read this two-part tutorial. Yes, I'm sorry, it is a plug. But I also really think it could help:

http://www.myotherpcisacloud.com/post/2011/11/23/Remote-Desktop-Services-Tutorial-1-(RD-Gateway).aspx

http://www.myotherpcisacloud.com/post/2011/11/25/Remote-Desktop-Services-Tutorial-2-(RD-Web-Access).aspx

share|improve this answer
    
Forgot to mention our server is on a domain. Would the cert store be included in the domain or local on the machine itself? Also, you mentioned RD Gateway. I don't think I have an RD Gateway Installed. I see where I can enable it. I was just going to expose the RDP port(3389), but I take it I should be using the gateway instead(port 443). We actually already use port 443 for HTTPS. Can Apache be used to redirect? SOrry for all the questions. I'm trying to figure the best approach. THanks! –  Jason Huntley Apr 23 '12 at 20:19
    
The cert is used in IIS for port 443 and would need to match the DNS names used externally. You can use SubjectAlternateName in the cert. I don't think apache can be redirected, but you could probably answer the request with IIS and redirect it to Apache. But that isn't something I can help with. –  MikeAWood Apr 23 '12 at 21:28
    
Hey Ryan Ries, thanks for the tutorials. Very descriptive and entertaining for a tech tutorial. I'm starting to figure it all out. Is the RD Gateway more secure than just using RDP over SSL? I might enable the Gateway, but only if it serves better security. I will have to host this on it's own separate port, like 7443 instead 443. 443 is already taken by our website. However, if I can manage to provide RDS over the standard port, I would prefer not to install and expose additional services. –  Jason Huntley Apr 24 '12 at 19:46
    
Yes, it's definitely best to expose as little as possible to the internet. RDP is reasonably secure, although not invincible. (MS12-020 was just a few weeks ago, but did not affect RD gateway.) RD Gateway which uses SSL is much better. Unfortunately, you will notice that you cannot change RD Gateway's port, and you cannot change the port that an RDP client will try to connect to when an RD Gateway is defined. You might consider getting an extra external IP for it. –  Ryan Ries Apr 24 '12 at 22:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.