RDP Self Signed Certificate 3389 Remote Desktop Protocol

Question

Tenable Nessus Scans showing self signed cert used for RDP on port 3389.

Done my due diligence -

1. Cert is located in certlm.msc > Remote Desktop
2. You can create a custom template and generate a cert to be used for RDP and put in that folder
3. Deleting the self signed - it just regenerates it when you reboot
4. Found some reg hacks to tell windows to use the generated cert
5. found some other permission hacks to stop self signed from being regenerated

through all that - some how RDP broke and I had to revert everything.

In short - this is classified as a medium vulnerability and it would be nice if MS would create a document or actual approved process to resolve this vulnerability.

Most articles I found were in relation to RDS which we don't use - this is just built in RDP to servers / workstations etc.

---

VULNERABILITIES

MEDIUM

PLUGIN ID57582

Description

The X.509 certificate chain for this service is not signed by a recognized certificate authority. If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host. Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.

Answer 1

Hello, 

This issue is not a bug. To use a self-signed certificate, you must establish a dedicated certificate service trust chain or acquire it from an organization that meets the necessary requirements.

--- 

If the Answer is helpful, please click "Accept Answer" and upvote it.