0


I need to RDP into multiple machines behind an external static IP. The method I'm using is to port forward selected ports to a target IP:3389. E.g.

forward 100.110.120.130:10001 to 192.168.1.101:3389
forward 100.110.120.130:10002 to 192.168.1.102:3389
etc...

Which works fine. But now I want to use SSL/TLS and secure the RDP sessions. I can use the RDP server auth certificate from the host machine and install it into the client machine trusted root CA store, however the name of the RDP host does not match the external IP address and I get a certificate error.

The external IP is static and won't change, but the port changes necessarily. So, can I use a wildcard certificate and map the static IP to a subdomain, and continue to use port forwarding in this way without encountering a certificate error?

Thank you all...

0

First, certificate subject (nor Subject Alternate Names extension) needs port information, because certificate identifies remote host, not specific service on remote host.

Second, certificate subject must match the name/address client types in the address bar/field. It doesn't need to match internal name/address.

This means that for your purposes it is safe to create single certificate with public IP/name in the Subject field. Distribute this certificate to all required clients behind your NAT and you will be fine.

  • Thanks @CryptoGuy. Just so that I'm clear - did you mean to say that certificate subject does not need port information? – khargoosh May 4 '15 at 21:31
  • Given the application (I'm the only person likely to use the certificate on an RDP client) Is a self-signed certificate acceptable for this purpose? – khargoosh May 4 '15 at 21:48
  • > did you mean to say that certificate subject does not need port information? -- exactly. – Crypt32 May 5 '15 at 9:40
  • > Is a self-signed certificate acceptable for this purpose? -- it is not recommended. – Crypt32 May 5 '15 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.