Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The server RDP certificate expires every 6 months and is automatically recreated, meaning I need to re-install the new certificate on the client machines to allow users to save password.

Is there a straightforward way to create a self-signed certificate with a longer expiry?

I have 5 servers to configure.

Also, how do I install the certificate such that terminal services uses it?

Note: Servers are not on a domain and I'm pretty sure we're not using a gateway server.

share|improve this question

You can create a self-signed certificate with many different tools. Makecert is one such tool:

The OID for 'Server Authentication' is, so the argument -eku will be in there somewhere.

makecert -r -pe -n CN="MyServer" -eku -ss my -sr localmachine -b 01/01/2000 -e 01/01/2036 

That should get you a self signed certificate in your computer's personal store that expires in 2036.

share|improve this answer

If you have a large domain, the best result would be to setup an enterprise Certificate Authority. Then just setup policies so that your system automatically acquire a valid certificate from the CA.

Also setup policies so that any certificates issued from that CA will be automatically trusted.

share|improve this answer

Completing Ryan Ries' answer above (as I've just worked out)

  1. Execute the makecert command suggested

makecert -r -pe -n CN="MyServer" -eku -ss my -sr localmachine -b 01/01/2000 -e 01/01/2036

  1. Manage Computer Certificates - you'll find the created certificate in Personal Certificates
  2. Export the certificate (right click -> all tasks -> export -> include private key -> give it a secure password)
  3. On the TS server, open RD Gateway Manager
  4. Right click on the TS Server -> Properties -> SSL Certificate tab
  5. Import the certificate should be good to go.

share|improve this answer
For clarity/my ignorance, what/where is TS Server? – Andy Joiner Sep 6 '14 at 9:47
Terminal Services server - your gateway server that's currently issuing the renewing certificate. – 9swampy Sep 6 '14 at 9:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.