5,099 questions
Hi
No I don't have a certificate error like this one when I connect directly with mstsc.
So I need to option 1 or 2? Witch one is more like a set it and forget it option?
Error: The connection has been terminated because an un expected server authentication certificate was receive from computer when I Disable one specific GPO
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 84%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDB%3C/text%3E%3C/svg%3E)
Dominique Beaulieu
1
Reputation point
Hi I have a new RDP Farm and we want to publish the desktop for the Terminal user. I have 4 server and we are connecting to the Broker and we are load balanced correctly. The issue are with the Rometo worker that will connect using the Citrix Netscaler Remote Desktop gateway. And according to the Citrix support, to be able to connect to a farm we need to disable the GPO "Use IP Address Redirection" and connect on the first RD session server. But when I do that I got the error "The connection has been terminated because an un expected server authentication certificate was receive from computer"
Windows for business | Windows Client for IT Pros | User experience | Remote desktop services and terminal services
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2021-03-03T05:17:03.24+00:00 Hi,
Thank you for posting your query. With the issue description, I would appreciate if you can help me with more information.
- What’s the version of the server and RDCB in your environment?
- What kind of certificate you are using? (self-signed rdp certificate or internal CA issued certificate or Public CA issued certificate)
if self-signed rdp certificate ,check the certificate expiration date in the remote desktop folder
if internal CA issued certificate or Public CA issued certificate ,check the certificate expiration date in the remote desktop folder in personal folder
3. Is there anything in the Eventlog on the problematical machine you are connecting to?
the Eventlog location
C:\Windows\System32\winevt\Logs
-
Dominique Beaulieu 1 Reputation point
2021-03-03T16:32:22.21+00:00 Hi
Thanks1-The Version of the Broker are 2019. Also the same for the Session server.
2-The Certificate are a internal CAI install it using the Server manager Deployment properties. It is not expired. If I connect to the Farm and check what is the certificate my cient receive, I can saw it the one I have install using the Server manager. But if look in Personal\Certificate and in Remote Desktop\Certificate I don’t see what I expected. In the Broker I saw my certificate in Personnal but not in Remote desktop. Instead in Remote Desktop I see the default self sign. On the Session server I saw a certificate deploy by my GPO for SCCM and in remote Desktop I saw a selfsign.
3- Nothing special in the event log Except that I have note when the GPO are disable when I connect using the Broker in the event log of the Broker I can see the server accept the connection and redirect me to the first available server. So look like the Certificate issue appear as soon I am redirected.
-
Dominique Beaulieu 1 Reputation point
2021-03-03T16:33:39.267+00:00 Here a screen shot of where I have add the Certificate. Sorry I was exceeding the 1000 characters.
-
Anonymous
2021-03-04T08:50:15.75+00:00 Hi,
According to the information above, Certificate Revocation List is required. CRL (Certificate Revocation List) is just a "list" of all revoked certificates of a Certification Authority. CDP was removed from certificate and CRL can't be found in Trusted Root Certification Authorities.
We have two options:- To setup CRL on CA server and then add CDP/CRL extension to certificate
- To install CRL certificate in Computer/Trusted Root Certification Authorities (it has to be valid).
Additonally, if we use mstsc to remote to the session host on our client, will this kind of error appear? If so, please screenshot and share the picture without your private information.
Sign in to comment
1 answer
Sort by: Most helpful
-
Dominique Beaulieu 1 Reputation point
2021-03-04T13:44:44.71+00:00 -
Anonymous
2021-03-08T08:14:31.663+00:00 Hi,
Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm.
If you disabel this, what will happen?
Sign in to comment -