We currently deploying six terminal servers in a farm that will be accessed by thin clients running Windows Embedded. The idea behind the thin clients is to have a seamless single-sign on whereby as soon as a user signs into the thin client, they are immediately connected to the RDS farm with no further prompts.
We have the single sign-on component working correctly (we're using 3rd party software that allows users to sign into the thin clients by tapping their employee badge against a proximity reader), but the user is still greeted with a certificate error before connecting. I want that to go away.
I can make this work with any of the servers individually by simply importing each server's self-signed cert into the thin client's trusted root CA, but it doesn't work when connecting to the farm.
The part I don't understand is that when the error pops up, the cert being presented is the self-signed cert from whichever server the TS broker routed the connection to, which should already be trusted. I'm guessing that the TS broker is a man-in-the-middle at that point maybe? I suspect I have to sign each server's RDP connection with the TS broker's cert, but I don't know how to do that. I get lots of conflicting information when I Google this. We have a root CA server, so this should be easy to do.
Here's our setup:
HYPERV-1 is our TS broker. It's a Server 2008 (non-R2) box.
HYPERV-2 and HYPERV-3 are Server 2012 R2 boxes hosting all the TS VMs.
TS-1 through TS-6 are the actual servers the users will be connecting to. They're Server 2008 R2
CA1 is our root CA server. It's a Server 2003 box.
Any help would be appreciated.