25

i'm using Remote Desktop on Windows 7 RC1, connecting to a Windows 2008 server.

Everytime i start a connection, i get the following popup window :-

enter image description here

The certificate problem makes sense -> it was created from my own server, which is not an offical certificate authority. Sure. So I need to tell my machine that any certificate that comes from my server, can u please accept.

So i View the certificate and install it. I let it determine the best place to install it. eg

enter image description here

Unfortunately, every time i connect, i still get that popup question.

So i tried to manually tell where to install it. I said to install it at eg.

enter image description here

but still i get the warning question.

So .. does anyone have any suggestions?

4
  • I don't suppose you have the original images for this? Imageshack has since deleted them. This question has a lot of views and lot of votes, so it would be nice to restore it if possible. Sadly archive.org does not have copies of imageshack photos. Oct 29, 2014 at 23:21
  • :( sincerly sorry @MarkHenderson, i do not.
    – Pure.Krome
    Oct 30, 2014 at 2:32
  • I have recreated them myself. Hopefully these were close enough to the original. Oct 30, 2014 at 3:48
  • Yeah - those ring bells. ta!
    – Pure.Krome
    Oct 30, 2014 at 8:13

9 Answers 9

27

The certificate needs to be added to your Local Computer's "Trusted Root Certification Authorities" store. Adding it to the user's "Trusted Root Certification Authorities" store is not enough! If this sounds confusing don't worry - it is.

If you think you already installed the certificate, skip to "Move Certificate on Client."

Export Certificate on Server

First the certificate needs to be exported to a file. On the server, i.e. the computer you'd like to connect to:

  1. Run %windir%\System32\mmc.exe
  2. Menu File -> Add/Remove Snap-in...
  3. Select Certificates -> Add > -> Computer account -> Local computer -> Finish
  4. OK the Add or Remove Snap-ins dialog. The console should now contain Certificates (Local Computer).
  5. Select Certificates (Local Computer) -> Remote Desktop -> Certificates. There should be a single certificate with your computer's name.
  6. Open the certificate.
  7. Open the Details tab.
  8. Copy to File...
  9. Select any format, e.g. DER encoded binary X.509 (.CER).
  10. Type in any file name, e.g. <computername>.cer.
  11. Copy the file to your client computer.

Another way to get the certificate is to follow steps 6 to 10 on your client computer, on the Remote Desktop warning dialog mentioned in the question. But you're trusting the network in this case. At least compare the fingerprints, so you can be sure you trust the right certificate.

Import Certificate on Client

On the client, i.e. the computer you're connecting from, an receive the warning popup, do:

  1. Run %windir%\System32\mmc.exe
  2. Menu File -> Add/Remove Snap-in...
  3. Select Certificates -> Add -> Computer account -> Local computer -> Finish
  4. OK the Add or Remove Snap-ins dialog. The console should now contain Certificates (Local Computer).
  5. Select Certificates (Local Computer) -> Trusted Root Certification Authorities -> Certificates.
  6. Menu Action -> All Tasks -> Import....
  7. Enter the path to the exported certificate, e.g. <computername>.cer.
  8. Place all certificates in the following store -> Trusted Root Certification Authorities.
  9. Finish. You should no longer receive the warning.

Move Certificate on Client

If you already installed the certificate through the warning dialog, you can find the certificate in the current user's store. Skip the steps above and just move the certificate to the right place:

  1. Follow steps 1 to 3 as described in "Import Certificate on Client."
  2. Add another Certificates snap-in, this time for My user account.
  3. The certificate should be here somewhere. Try Certificates - Current User -> Intermediate Certification Authorities -> Certificates first.
  4. Drag-and-drop or cut-and-paste the certificate to Certificates (Local Computer) -> Trusted Root Certification Authorities -> Certificates. Note that the certificate stores stack, so you will still see the certificate in you user's store! You should no longer receive the warning.
2
  • 2
    Nice post, and I have a followup, which I'm happy to post to a new question. How could this be done on a grander scale? i.e. Is it possible to generate and import a wildcard certificate to allow connection to all computers on the same domain? Aug 14, 2012 at 22:17
  • Would this automatically happen if you just check the “Don’t ask me again for connections to this computer” checkbox? Why do you recommend importing the certificate instead of using that?
    – binki
    Jan 25, 2019 at 16:20
4

I think you need to check the path of the certificate and have your computer trust the actual root and/or intermediates and not the certificate itself. You can also see under the path tab where the actual problem lies...

On the pictures the certificate you're installing doesn't seem to be invalid - the root of the problem is.. eh.. that was a stupid pun, sorry ^^

3
  • sure .. but how?
    – Pure.Krome
    May 13, 2009 at 11:04
  • If you click the Certification Path tab you've posted and select the root node in the tree (or whatever node is showing a problem) you can view that instead and then install it or whatnot... May 13, 2009 at 14:54
  • After clicking on the Certification Path tab the only way I found to install a certificate higher up the tree was to click on Copy to File... and then install that file. The certificate was showing correctly in my certification snap-in, however, it did not solve the problem. Aug 26, 2011 at 15:19
2

If you created the certificate yourself, then you must have the Certification Authority installed on your server. You need to obtain the root certificate from your certification authority, and install that into the Trusted Root Certification Authorites store - not the certificate that it issued to the RDP server.

2

I could not get the certificate to be accepted using anything suggested however you can adjust the certificate handling functionality in the RDP settings so that it is not required to start an RDP session.

  1. Open RDP instance and click options
  2. Then click advanced tab
  3. Select "Connect and don't warn me" from the Server authentication section
  4. Then just set the other details as normal and press connect.

This will stop the certificate authentication block occurring.

2
  • That's actually a pretty smart thing to do :) I might just try that :P
    – Pure.Krome
    May 26, 2010 at 13:13
  • 10 years later and still usefull! Anyway, I'm using Remote Desktop Connection Manager and this option is under Properties\Security Settings and "Connect and don't warn if authentication fails" must be selected.
    – Raphael
    Jul 9, 2020 at 0:54
1
  1. Click "View Certificate..."
  2. Click "Install Certificate"
  3. Click "Next" in the import wizard
  4. Select the "Place all certificates in the following store" radio button
  5. Click "Browse..."
  6. Check the "Show physical stores" checkbox
  7. Expand Third-Party Root Certification Authorities
  8. Select "Local Computer"
  9. Click "OK"
  10. Click "Next", then "Finish" to complete the wizard
1

I just sorted this out on my own system, I hope it isthe same issue refereed to here. It appears that the certificate import wizard that remote desktop invokes does not store the certificate in the trusted root certification authorities store even though the wizard indicates that the the import was successful.

This can be verified by invoking mmc from the counsel and adding the certification snap-in to view the contents of the trusted root certification authorities store.

The workaround is to save the certification (from the host) to a file, then on your client import the file using mmc to the trusted root certification authorities store on your client computer.

I think that this may be a bug introduced in win 7 sp1 (or a feature...)

2
  • this occurred for me BEFORE SP1 ... but that's pretty interesting. I'll give it a go :) Clarification: do you suggest that we save the cert (export the cert) on the host server first? then copy it from the host server to the client?
    – Pure.Krome
    Apr 9, 2011 at 1:31
  • That should work, the problem seems to be (at least from what I have seen) the import wizard associated with the client side of the remote terminal. I have also had success viewing then saving the certificate to disk while first connecting to the host from the client side then using mmc to import the cert into the trusted cert store. The key seems to be using mmc to import rather than the wizard
    – Don
    Apr 15, 2011 at 3:56
0

When selecting the certificate store check the 'Show physical stores' box and save the certificate to 'Trusted Root Certification Authoritites > Local Computer'

1
0

Right above the View Certificate button, you have a checkmark stating Do not ask me again for connections to this computer. Check it.

1
  • Nope - that's not exactly what I want. True, i don't get asked that annoying question .. but behind the scenes the certificate is still not trusted (even though it doesn't really matter).
    – Pure.Krome
    May 6, 2010 at 14:28
-1

I've only had brief and painful experiences with certificates, but my suggestion would be to try the Personal store instead of Trusted Root Certification Authorities.

1
  • I thought the Personal stored was the default one? I still got asked to accept the cert, even after i imported it into the persone store, manually.
    – Pure.Krome
    May 13, 2009 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .