1

We currently deploying six terminal servers in a farm that will be accessed by thin clients running Windows Embedded. The idea behind the thin clients is to have a seamless single-sign on whereby as soon as a user signs into the thin client, they are immediately connected to the RDS farm with no further prompts.

We have the single sign-on component working correctly (we're using 3rd party software that allows users to sign into the thin clients by tapping their employee badge against a proximity reader), but the user is still greeted with a certificate error before connecting. I want that to go away.

I can make this work with any of the servers individually by simply importing each server's self-signed cert into the thin client's trusted root CA, but it doesn't work when connecting to the farm.

The part I don't understand is that when the error pops up, the cert being presented is the self-signed cert from whichever server the TS broker routed the connection to, which should already be trusted. I'm guessing that the TS broker is a man-in-the-middle at that point maybe? I suspect I have to sign each server's RDP connection with the TS broker's cert, but I don't know how to do that. I get lots of conflicting information when I Google this. We have a root CA server, so this should be easy to do.

Here's our setup:
HYPERV-1 is our TS broker. It's a Server 2008 (non-R2) box.
HYPERV-2 and HYPERV-3 are Server 2012 R2 boxes hosting all the TS VMs.
TS-1 through TS-6 are the actual servers the users will be connecting to. They're Server 2008 R2
CA1 is our root CA server. It's a Server 2003 box.

Any help would be appreciated.

6
  • Do you have Certificate auto-enrollment setup for the computers in your domain(servers/workstations)? So to just bypass this problem all-together?
    – Sarge
    Jun 4, 2014 at 19:10
  • 1
    Nope. No auto-enrollment. The Root CA was set up a long time ago just to support WPA2-Enterprise on our wireless LAN. Other than that, we don't really have a proper PKI infrastructure around here. CA-1 and HYPERV-1 certs are being distributed via Active Directory, however.
    – Wes Sayeed
    Jun 4, 2014 at 19:15
  • I would highly recommend you setup auto-enrollment with a offline root ca and subordinate. Its very easy and will save you a million headaches of exporting and importing certificates all over the place. Once auto-enrollment is setup the servers will automatically issue themselves the needed certificates. So will the workstations. If your going though all the trouble of setting up a RDS farm do it right.
    – Sarge
    Jun 4, 2014 at 19:18
  • Btw just as side question. you did setup the brokers RDP-TCP properties certificate right?
    – Sarge
    Jun 4, 2014 at 19:21
  • Unfortunately, my knowledge of PKI is very limited. I can export certificates, install them, and distribute them in Group Policy, but that's about it. Our root CA hails from before my time. And no, the broker is also using its own self-signed cert as well.
    – Wes Sayeed
    Jun 4, 2014 at 19:42

0

You must log in to answer this question.