0


I need to RDP into multiple machines behind an external static IP. The method I'm using is to port forward selected ports to a target IP:3389. E.g.

forward 100.110.120.130:10001 to 192.168.1.101:3389
forward 100.110.120.130:10002 to 192.168.1.102:3389
etc...

Which works fine. But now I want to use SSL/TLS and secure the RDP sessions. I can use the RDP server auth certificate from the host machine and install it into the client machine trusted root CA store, however the name of the RDP host does not match the external IP address and I get a certificate error.

The external IP is static and won't change, but the port changes necessarily. So, can I use a wildcard certificate and map the static IP to a subdomain, and continue to use port forwarding in this way without encountering a certificate error?

Thank you all...

1 Answer 1

0

First, certificate subject (nor Subject Alternate Names extension) needs port information, because certificate identifies remote host, not specific service on remote host.

Second, certificate subject must match the name/address client types in the address bar/field. It doesn't need to match internal name/address.

This means that for your purposes it is safe to create single certificate with public IP/name in the Subject field. Distribute this certificate to all required clients behind your NAT and you will be fine.

4
  • Thanks @CryptoGuy. Just so that I'm clear - did you mean to say that certificate subject does not need port information?
    – khargoosh
    May 4, 2015 at 21:31
  • Given the application (I'm the only person likely to use the certificate on an RDP client) Is a self-signed certificate acceptable for this purpose?
    – khargoosh
    May 4, 2015 at 21:48
  • > did you mean to say that certificate subject does not need port information? -- exactly.
    – Crypt32
    May 5, 2015 at 9:40
  • > Is a self-signed certificate acceptable for this purpose? -- it is not recommended.
    – Crypt32
    May 5, 2015 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .