Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The server RDP certificate expires every 6 months and is automatically recreated, meaning I need to re-install the new certificate on the client machines to allow users to save password.

Is there a straightforward way to create a self-signed certificate with a longer expiry?

I have 5 servers to configure.

Also, how do I install the certificate such that terminal services uses it?

Note: Servers are not on a domain and I'm pretty sure we're not using a gateway server.

share|improve this question

3 Answers 3

You can create a self-signed certificate with many different tools. Makecert is one such tool:

http://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.110).aspx

The OID for 'Server Authentication' is 1.3.6.1.5.5.7.3.1, so the argument -eku 1.3.6.1.5.5.7.3.1 will be in there somewhere.

makecert -r -pe -n CN="MyServer" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localmachine -b 01/01/2000 -e 01/01/2036 

That should get you a self signed certificate in your computer's personal store that expires in 2036.

share|improve this answer

Completing Ryan Ries' answer above (as I've just worked out)

  1. Execute the makecert command suggested

makecert -r -pe -n CN="MyServer" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localmachine -b 01/01/2000 -e 01/01/2036

  1. Manage Computer Certificates - you'll find the created certificate in Personal Certificates
  2. Export the certificate (right click -> all tasks -> export -> include private key -> give it a secure password)
  3. On the TS server, open RD Gateway Manager
  4. Right click on the TS Server -> Properties -> SSL Certificate tab
  5. Import the certificate

...you should be good to go.

share|improve this answer
    
For clarity/my ignorance, what/where is TS Server? –  Andy Joiner Sep 6 at 9:47
1  
Terminal Services server - your gateway server that's currently issuing the renewing certificate. –  9swampy Sep 6 at 9:49

If you have a large domain, the best result would be to setup an enterprise Certificate Authority. Then just setup policies so that your system automatically acquire a valid certificate from the CA.

Also setup policies so that any certificates issued from that CA will be automatically trusted.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.