9

I installed windows server 2016 for a small company, so I don't need to have domain controller on this installation and for RDS I only need RD Licensing and RD Session Host roles. But only with that roles theres is no Remote Desktop Gateway which is used in many tutorials to install SSL certificate on terminal server (like here: https://ryanmangansitblog.com/2013/03/27/deploying-remote-desktop-gateway-rds-2012/).

So to conclude, I just don't have interface of Remote Desktop Gateway to install SSL certificate.

Is there any workaround to deal with it and install SSL cert on my RDS?

3 Answers 3

16

Finally I found solution!

  1. First of all, name of the server had to be changed by adding DNS suffix. For example, if you want to connect to the server by srv.example.com address, your server name should be "srv" and DNS suffix "example.com". It can be done in computer properties.
  2. Then setup licensing in "RD Licensing Manager"
  3. Now issue certificate to domain name srv.example.com (i.e. in Let's encrypt)
  4. Convert let's encrypt cert files into windows one via: openssl pkcs12 -export -out certificate.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem (Linux command) if you issued certificate with help of acme.sh, you command should look like: openssl pkcs12 -export -out certificate.pfx -inkey yourdomain.com.key -in yourdomain.com.cer -certfile fullchain.cer
  5. Install converted certificate to personal store at the computer level. Not at user level
  6. Then with this command display the thumbprint of the certificate, copy it to a text file or something similar: Get-ChildItem "Cert:\LocalMachine\My"
  7. This is a variable to set the WMI path to the RD Session Host RDP listener (Where the certificate needs to be changed): $PATH = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices)
  8. Finally this is the command to change the active certificate on the RDP listener: Set-WmiInstance -Path $PATH -argument @{SSLCertificateSHA1Hash="thumbprint"} The "thumbprint" above, is the value you noted earlier, just insert it between the ".
  9. Well done! Now you have RDP server with custom SSL cert without installing RD Gateway Credits
5
  • 1
    Thank you very much! I followed steps 1, 5, 6, 7, 8 and it worked! By the way, step 8 needs administrator privilege to run.
    – Ricky
    Jul 17, 2019 at 5:55
  • I had Invalid parameter with these instructions. After a lot of random poking, I got this to work. Instead of the -Path parameter I used the -InputObject parameter and then it worked.
    – Radu C
    Oct 7, 2020 at 13:59
  • Hi @RaduC i've tried change -Path to -InputObject but still had Invalid Parameter. Any clue? Thank you.
    – kholis
    Dec 6, 2022 at 2:53
  • @kholis I, too, continued to have an Invalid Parameter issue, after loading a renewed cert. It seems that the method in this solution requires that the cert include the private key (it should be exportable as pfx, with the extra little star on the icon). This will be the case if you've created the pfx for import as in Step 4. Apr 12, 2023 at 15:59
  • @LarsRohrbach you were right. The private key should be import to pfx file along with cert file.
    – kholis
    Aug 24, 2023 at 3:38
3

Launch certlm.msc and import the cert into the "Personal -> Certificates" store. After it's installed, launch Server Manger and select the Remote Desktop role icon on the left. click the "Tasks" dropdown in the "Deployment Overview" section, then click "Edit Deployment Properties" in the context menu that appears. You'll be able to assign the certificate you imported to roles by clicking the "Select existing certificate" button.

You should still configure the certificate settings whether or not you have the Gateway role installed.

2
  • 1
    Hi! Thanks for reply! I don't have "Deployment Overview" interface as I don't have domain role on my server and I don't need it: i.imgur.com/qYGCbpI.png Aug 20, 2018 at 8:59
  • This answer assumed you have the Remote Desktop Services role installed, which is a paid extra for more complex setups.
    – Radu C
    Oct 7, 2020 at 14:01
1

Partly solution with the help of MS community I have found there: https://www.risual.com/2014/03/10/setting-up-a-2012-r2-rds-gateway-for-a-workgroup/. Summary to this article: to make license server issue certificates just to the Internet address like that srv.example.com instead of only "example" (computer name) the DNS suffix should be added in computer properties:enter image description here

By the way, the problem still exists in the way that the server for RDP connections still uses self-issued certificate (even If I am deleting it and leaving only let'sencrypt cert). On each RD services restart it issues new one instead of using mine. How can I make it to use lets encrypt cert? enter image description here

Of course, I know, that I can export public key for self-generated cert and add it to employee's PCs, but it is not good solution in my opinion.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .