I'm trying to setup Remote Desktop Gateway (Terminal Service Gateway) on virtual Windows Server 2012 R2. But when connect over internet (from Win7 RDP client) getting an error:

Your computer can't connect to the remote computer because the Remote Desktop Gateway server address requested and the certificate subject do no match.

Here's my configuration:

  • Host is running Windows Server 2008 R2 Std
  • RDG is running Windows Server 2012 R2 Std virtually (I also tried 2008 R2 with equal result)
  • AD is virtual also (dc.domain.local, etc.)
  • Host is server.domain.local
  • Host is running RRAS with NAT so port host:33899 is forwarded to rdg:3389
  • RDG is rdg.domain.local
  • RDG uses self-signed SSL certificate for example.com set in Gateway Manager:

Whatever name I would use for SSL certificate, client sees it with Subject=rdg.domain.local!

enter image description here

I also tried create a self-signed certificate manually using makecert and use/import it but with equal result.

2 Answers 2


Apparently MS botched the instruction somewhat.

I believe you need to create the cert request in iis manager on the rdg gateway computer. The request needs to specify the fqdn used by the clients to connect over the internet. For processing the request signing you use a CA trusted by your client computers. If you have full control over the client computers you can use your own CA, as long as they trust your CA root certificate. Otherwise use a commercial CA such as Verisign, Thawte or such. After importing the signed cert to iis it should be available for import to your rdg gateway.

It is all documented in the official guide: http://technet.microsoft.com/en-us/library/dd983941%28WS.10%29.aspx

including the helpful if ranting comment at the bottom of http://technet.microsoft.com/en-us/library/dd983949(v=ws.10).aspx

And except apparently this little detail: http://blog.xiquest.com/2010/01/rd-gatewayweb-access-outside-the-firewall/

"Open up “IIS Admin” console from the “Administrative Tools” menu. Navigate to the default web site and configure the “Application Settings” for “Default Web Site\RDWeb\Pages“. Change the following setting: “DefaultTSGateway” = [fqdn of Internet accessible TS Gateway]

Note: make sure this is also the server name listed on your SSL certificate."

I'll tidy up this post as soon as I get behind a proper computer.

  • Thanks for stopping by! I tried both creating self-signed cert by RDG snap-in and makecert.exe. A control both client, host and rdg vm. First I'm getting an error saying you can't trust self-signed cert. Then I add it to Trusted Root Auth. After that I'm getting an error saying address not match. And this is true, cert subject is local domain net instead of public. However I always create a cert for public one. Commented Nov 24, 2013 at 5:25
  • I'm wondering where exactly or where also should I specify the cert. Because the one is observed from client is definitely different from what I set in RDG Manager. For instance, expiration date. And of course subject name. Commented Nov 24, 2013 at 6:20
  • I'm in iphone land and can't put time on this right now, but here's an mvp take on the procedure. If it works, please indicate what actual step made the difference vs how you initially did it: concurrency.com/blog/…
    – ErikE
    Commented Nov 24, 2013 at 8:46
  • I read and tried this article already. But his case is different in setting up RD Web Access. Where looks like in wizard you rally can specify internal and external domain names. Also RD Virtualization Host installation requires physical (hardware-assisted virtualization) servers and my is virtual. So on Server Manager -> Overview I have an error message instead of fancy visualization like he has. Commented Nov 24, 2013 at 9:02
  • Looks like it makes sense to ask him in the comments. Commented Nov 24, 2013 at 9:04

Here's the steps I took to make it working:

  • Issue an SSL certificate with subject matching public DNS name (FQDN)
  • Use default port 3389/TCP otherwise SSL certificate name won’t match FQDN returning an error:

    The computer can’t verify the identity of the RD Gateway.

    or if you put it to current user’s Trusted Root Certification Authorities:

    Your computer can’t connect to the computer because the Remote Desktop Gateway server address requested and the certificate name do not match.

  • Publish HTTPS port 443/TCP as well. Otherwise connection won’t be established returning another meaningless error:

    Your computer can’t connect to the remote computer because the RDG server is temporarily unavailable.

See my blog post about it.

  • 1
    What do you mean by 'publish HTTPS port 443/TCP'?
    – Alan B
    Commented Mar 2, 2015 at 16:54
  • @AlanB: forward it from public IP/firewall to the gateway machine. In my case the web server previously was listening it. Commented Mar 2, 2015 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .