Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup Remote Desktop Gateway (Terminal Service Gateway) on virtual Windows Server 2012 R2. But when connect over internet (from Win7 RDP client) getting an error:

Your computer can't connect to the remote compiter bcaseu the Remote Desktop Gateway server address requested and the certificate subject do no match.

Here's my configuration:

  • Host is running Windows Server 2008 R2 Std
  • RDG is running Windows Server 2012 R2 Std virtually (I also tried 2008 R2 with equal result)
  • AD is virtual also (dc.domain.local, etc.)
  • Host is server.domain.local
  • Host is running RRAS with NAT so port host:33899 is forwarded to rdg:3389
  • RDG is rdg.domain.local
  • RDG uses self-signed SSL certificate for example.com set in Gateway Manager:

Whatever name I would use for SSL certificate, client sees it with Subject=rdg.domain.local!

enter image description here

I also tried create a self-signed certificate manually using makecert and use/import it but with equal result.

share|improve this question
add comment

1 Answer 1

Apparently MS botched the instruction somewhat.

I believe you need to create the cert request in iis manager on the rdg gateway computer. The request needs to specify the fqdn used by the clients to connect over the internet. For processing the request signing you use a CA trusted by your client computers. If you have full control over the client computers you can use your own CA, as long as they trust your CA root certificate. Otherwise use a commercial CA such as Verisign, Thawte or such. After importing the signed cert to iis it should be available for import to your rdg gateway.

It is all documented in the official guide: http://technet.microsoft.com/en-us/library/dd983941%28WS.10%29.aspx

including the helpful if ranting comment at the bottom of http://technet.microsoft.com/en-us/library/dd983949(v=ws.10).aspx

And except apparently this little detail: http://blog.xiquest.com/2010/01/rd-gatewayweb-access-outside-the-firewall/

"Open up “IIS Admin” console from the “Administrative Tools” menu. Navigate to the default web site and configure the “Application Settings” for “Default Web Site\RDWeb\Pages“. Change the following setting: “DefaultTSGateway” = [fqdn of Internet accessible TS Gateway]

Note: make sure this is also the server name listed on your SSL certificate."

I'll tidy up this post as soon as I get behind a proper computer.

share|improve this answer
    
Thanks for stopping by! I tried both creating self-signed cert by RDG snap-in and makecert.exe. A control both client, host and rdg vm. First I'm getting an error saying you can't trust self-signed cert. Then I add it to Trusted Root Auth. After that I'm getting an error saying address not match. And this is true, cert subject is local domain net instead of public. However I always create a cert for public one. –  abatishchev Nov 24 '13 at 5:25
    
I'm wondering where exactly or where also should I specify the cert. Because the one is observed from client is definitely different from what I set in RDG Manager. For instance, expiration date. And of course subject name. –  abatishchev Nov 24 '13 at 6:20
    
I'm in iphone land and can't put time on this right now, but here's an mvp take on the procedure. If it works, please indicate what actual step made the difference vs how you initially did it: concurrency.com/blog/… –  ErikE Nov 24 '13 at 8:46
    
I read and tried this article already. But his case is different in setting up RD Web Access. Where looks like in wizard you rally can specify internal and external domain names. Also RD Virtualization Host installation requires physical (hardware-assisted virtualization) servers and my is virtual. So on Server Manager -> Overview I have an error message instead of fancy visualization like he has. –  abatishchev Nov 24 '13 at 9:02
    
Looks like it makes sense to ask him in the comments. –  abatishchev Nov 24 '13 at 9:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.