0

I have a Windows 2008 R2 terminal server. When accessed over the web (ex. https://ts.domain.com/RDWeb) I get a message that the SSL certificate has been revoked. It appears to be issuing an old SSL certificate, that has since been updated with an additional alternate name (SAN).

However, when I access the same URL from the LAN or VPN, the RDWeb page displays correctly with no revoke error. When I inspect the SSL certificates in the web browser, the LAN/VPN client shows the serial number for the update cert. The outside client's web browser will show the serial number for what I believe is the old cert.

The firewall handling the outside clients is a Cisco ASA 5510, which to my knowledge does not need to be updated with the SSL certificate (compared to some firewalls like ISA that might).

When I run this command:

certutil -store MY

It only shows the SSL certificate with the current serial number (the one issued LAN/VPN clients), and the serial number that is getting issued to outside clients is not to be found.

It is also worth noting that I reused the SSL cert from the Exchange server, added a SAN for the terminal server, exported it from the Exchange server and imported it to the terminal server. It worked in my initial testing, but now I'm seeing this issue, and I'm wondering if it just needs its own SSL certificate.

EDIT: Over VPN, Chrome gives the revoke error, but IE and Firefox open without problems. Chrome works fine on the LAN.

Improve this question
2
  • Maybe it is using the RDP certs, in Powershell run ls "Cert:\LocalMachine\Remote Desktop" | fl * and see whether this matches your cert.
    – Peter Hahndorf
    Jan 31, 2014 at 17:10
  • I only see a self-signed cert listed there, which is not in use. The same UCC cert I'm using for RDWeb is also being used for RemoteApp published apps without problems, but they are all on the LAN.
    – user1594322
    Jan 31, 2014 at 17:20

1 Answer 1

Reset to default
0

Issue was related to an old public DNS record that was never removed, so outside users were randomly getting the right/wrong public IP address.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .