2

A few servers are getting picked up by security scans with the following message:

The following certificate was at the top of the certificate chain sent by the remote host, but it is signed by an unknown certificate authority. | Subject : CN=serverabc.local | Issuer : CN=serverabc.local

The port referenced in the scan is port 3389 (RDP). The default RDP certs on each server (in the Remote Desktop cert store) are self-signed and still valid.

I think the issue comes down to the cert being self-signed and not being signed by a CA.

Would the following steps resolve this issue?

  1. Create an internal Certificate Authority
  2. Generate new CSR's for the vulnerable servers
  3. Sign newly created CSR's with the mentioned CA
  4. Replace current (existing) self-signed RDP certs in the Remote Desktop cert store with the CA signed certs on each vulnerable server

Is there any potential issue/problems with swapping out the existing cert with a CA signed cert?

I'd appreciate any help/guidance with resolving this, thanks.

Improve this question

1 Answer 1

Reset to default
0

Certificates issued by the internal CA will only be trusted by clients that have the certificate in their certificate store (your domain members and other infrastructure where you install the certificate), which the security scanner surely won't have.

To use a certificate that will be trusted by the security scanner, you'll surely need to purchase a commercial certificate.

Improve this answer
1
  • Downvoting, because offline security scanners often have an ability to use either, local trust certificate store (on a hosting machine which is part of enterprise environment and likely has internal root CA cert) or an option to add trusted root certificate in scanner configuration.
    – Crypt32
    Dec 19, 2021 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .