Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up a Remote Desktop Services farm, and am having trouble configuring certificates for it to use. A demonstration of the problem I'm seeing can be found in Step #4.

At this point I am convinced that there are problems with the user interface, and am looking for ways around them. Is there any way to configure certificates in Remote Desktop Services so that the settings hold and are reflected in the GUI? If not, is there any way for me to verify that the settings are correct?

Step #1 - Create certificate to be used.

I've configured a certificate to use with RD Web Access. The certificate is stored with in the Certificates MMC on my RD Connection Broker, and I am configuring the farm from that computer. certificate

I found by letting RD Web Access generate its own certificate that the following properties are required:

  • Enhanced Key Usage
    • Server Authentication
    • Client Authentication
      • This may not be required, but the self-signed certificate includes it.
  • Key Usage
    • Digital Signature
    • Key Agreement
  • Subject Alternative Name
    • DNS Name=domain.com

Detour about self-signed certificate generation

As a quick detour, I was able to work around a problem with creating self-signed certificates using powershell. The documentation for the New-RDCertificate cmdlet gives the following example:

PS C:\> $password = ConvertTo-SecureString -string "password" -asplaintext -force
New-RDCertificate -Role RDWebAccess -DnsName "test-rdwa.contoso.com" -Password $password -ConnectionBroker rdcb.contoso.com -ExportPath "c:\test-rdwa.pfx"

Typing this into the shell will result in an error message claiming that a function, Get-Server cannot be found. Prior to using New-RDCertificate, you must import the RemoteDesktop Module with Import-Module RemoteDesktop.

Step #2 - Observe out-of-box behavior

The first time you visit the Deployment Properties dialog box by navigating to Server Manager -> Remote Desktop Services -> Collections and selecting "Edit Deployment Properties" from the "TASKS" dropdown list in the "COLLECTIONS" grouping, you will see the following screen: enter image description here

This window is misleading because the level field is listed as "Not Configured". If I understand correctly all three of the role services are using a self-signed certificate. For the RD Web Access role this can be verified by visiting the website: certificate error

The certificate being used also appears in the Certificates MMC: certificates MMC showing the RD Web Access certificate

Step #3 - Assign new certificate

The Deployment Properties dialog box will allow me to select my existing certificate. The certificate must be placed within the local computers Certificates MMC in the "Personal" certificate store. The private key will need to be exportable, and you will need to provide the password. I temporarily exported my certificate to a file named temp.pfx with a password, and then imported it into Remote Desktop Services from there.

Once this is done the GUI will indicate that it is ready to accept the new configuration. ready to accept certificate

Once I click the "Apply" button, the GUI indicates success. enter image description here

This can be verified by visiting the RD Web Access web site a second time. There is no certificate error. enter image description here

Step #4 - The GUI fails to maintain its state

If the GUI is closed and reopened, all of these settings appear to be lost. settings are lost

Actually, the certificate I configured is still being used. I am able to continue accessing the RD Web Access site without any certificate errors.

Oddly, if I use the "Create new certificate..." button to generate a self-signed certificate this window will update to an "Untrusted" level. This setting will then be maintained through the opening and closing of the Deployment Properties dialog box.

Is there anything I can do to have my settings appear to stick? I feel like something is wrong when the GUI claims I haven't fully configured certificates.

share|improve this question
7  
This is a very well thought-out question. Kudos. –  Ryan Ries Feb 8 '13 at 17:55
    
Excellent question; too bad can't assign more +1's.. Don't have lab for testing but found some good links: technet.microsoft.com/en-us/library/cc730805.aspx. technet.microsoft.com/en-us/library/cc725949.aspx youtube.com/watch?v=D6UBsuCuJs8 and rivald.blogspot.com/2011/06/… Also: blog.kristinlgriffin.com/2010/07/… –  Lizz Feb 25 '13 at 6:49
    
Any luck yet Michael? –  Lizz Mar 9 '13 at 6:35
    
@Lizz As far as I can tell the certificate we're using for the RD Web Access role service is being accepted by clients. The user interface continues to report "Not Configured" even though it's actually using the certificate I specified. –  Michael Steele Mar 11 '13 at 19:03
    
Like your blurring. Not the traditional kind. –  Ian Carroll Mar 19 '13 at 23:27

1 Answer 1

I checked our farm yesterday and noticed that is Windows 2008... Yours is 2012. I'm sure there are big differences, but I hope my info helps.

Opening MMC -> Certificates -> Computer account I see 2 certificates in "personal/Certificates" folder:

  • Selfsigned Certificate (same Issuer an Subject)
  • Certificate issued by our Domain CA

The selfsigned shows an error in the details, has your certificate the same error? Error

To solve this error, just copy and paste the certificate from "personal/Certificates" subfolder to "Trusted Root Certification Authorities/Certificates". With that step the same certificate gives no error. OK Certificate

After that, there's only two places where you configure the certificate (in RDS Windows 2008) that I've found.

Our RemoteApp Manager shows: Main

The Digital Signature settings: DSS

And in the 'RD Session Host Configuration, in the settings of the connection: RDSHC

At the end, and if I remember correct, we solved it checking all options, the event viewer, making sure of no certificate errors, populating some local groups, giving them access by the Security Policy...

Good Luck.

---- Updated ----

Remember to import in the user profile, the Issuer CA or the certificate (if it's self signed) in the "Trusted Root Certification Authorities/Certificates" so the client didnt get any certificate error. This point was important in our system.

share|improve this answer
    
Thanks for the information. We are using certificates signed by our own CA. The problem I'm having is unique to Windows Server 2012. The GUI claims that certificates are not configured correctly or even at all. –  Michael Steele Mar 27 '13 at 17:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.