- Using CA certificate for Remote Desktop Connection
- Configure custom SSL certificate for RDP on Windows Server 2012 in Remote Administration mode?
to secure RDP with a proper cert instead of the self-signed Windows one. This all works well. Until I run
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="MY_HASH"
This command only results in "Invalid param".
The same command works well with the hash of the original (self-signed Windows) cert. So I guess something must be wrong with my cert. It seems to be properly installed in the cert store (with private key & under "Remotedesktop" subsection).
Looking at the cert details in the certification MMC snapin my imported cert has a yellow exclamation mark next to:
Key Usage = Digital signature, key encryption (a0)
and the additional field
Base Limitations = Type of requester: end unit
While the self-signed cert that Windows generates for the RDP connection has:
Key Usage = Key encryption, data encryption (30)
Is there anyway to change this, or is it just not possible to use this cert for RDP?
Some additional info:
- The cert is a COMODO PositiveSSL Wildcard cert,
- I converted the cert from the original PEM form to PKCS7 and from PKCS7 to PKCS #12/PFX using OpenSSL prior to importing it to the Windows cert store,
- Another difference between the certs is that the Windows one is a sha1 one while the Comodo cert is a sha256 one,
- It's a Win10 workstation,
- The workstation is not member of any domain but a stand-alone installation.