Our servers undergo periodic PCI compliance scans and we have a Windows 2008 server machine that we have port 3389 open for RDP. It is secured with SSL, but it is failing the scan because their test says:
SOLUTION:
Please install a server certificate signed by a trusted third-party Certificate Authority.
RESULT:
Certificate #0 unable to get local issuer certificate
As far as I can tell, the reason its failing is because in the Terminal Services Configuration tool it is using a locally created certificate instead of the one we got from GeoTrust. So, I open the wizard and it says the certificate is "Auto Generated." I click the SELECT button, change to the one we were issued from GeoTrust and hit OK to save everything (screen shot). However, then I disconnect my RDP session and reconnect and its back to "Auto Generated." I've even tried deleting the certificate from the MMC Local Computer Certificate snap-in and it just keeps recreating itself every time we reconnect through RDP. I can "pass" the scan by going through those motions and re-running the scan before I log in again with RDP, but that's hardly a permanent solution as these scans run every month.
Can anyone help me figure out how to get the trusted CA SSL cert to stick around permanently?
Thanks in advance.