I was recently informed on SF that using a self-signed certificate for RDP over a public interface is not recommended. In this particular scenario, I'd like to understand more about why.

The situation is this: I RDP into a network by port-forwarding to independent machines on the LAN through a static IP. For example:

External forward to
External forward to
And so on.

Each machine I need to RDP into (each RDP host) has a self-signed private key, and my RDP client (only this single machine) has the public certificates. The certificates are in the Trusted Root CA store on each machine. The subject CN of the certificate is the static IP

If I configure IPSec on each LAN machine to require inbound/outbound ident/auth/encryption with this and only this certificate on TCP:3389 and UDP:3389, and I'm the only guy with the public keys, can you help me understand the risks in this scenario?

Thanks in advance!

  • The universal problem with self-signed certificates is that although they provide encryption they do not guarantee the identity of the remote server and services you're connecting to. You seem to mitigate that problem by using IPSec for mutual authentication at the TCP/IP level rather than a specific service. – HBruijn May 6 '15 at 4:46
  • Thanks @HBruijn. Presumably this is also mitigated through the fact that I installed the private key on the remote machine/server myself, and didn't install it anywhere else, and then connect to the machine via a static IP. – khargoosh May 6 '15 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.