RDS Session Host certificate never trusted?

Question

Hi all,

I've successfully deployed an RDS farm, all server running Server 2019 STD.

1x server running RDWeb & GW roles
1x server running Connection Broker & LIC server roles
2x server running RDS Session Host role

Using internal PKI certificates I have the system working 95%. I've deployed the RDWeb HTML client and can successfully connect using RDWeb no problems at all.

What I have a small problem with is using the MSTSC client application to work seamlessly with my GW server address configured. It works but in the final step of connecting an untrusted certificate warning prompt is thrown.

If I view the certificate and trace its thumbprint back - this certificate is a self-signed certificate sitting locally on the session host server's internal store - Remote Desktop\Certificates

Why is this cert self signed and why is it demanding it? I have issued certificates from my internal PKI that chain back successfully to a trusted ROOT but even if I place that cert in the same store it does not get used and the connection always prompts for the self signed certificate in the "Remote Desktop" store?

Do I need to bind my self signed cert somewhere?

Answer 1

Hey,

By default, RDP will use the self-signed certificate not an internal CA.

Here is a great article about Certificate Warnings:
https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/remote-desktop-connection-rdp-certificate-warnings/ba-p/259301

If you provide access to external users, I would recommend wildcard certificate from a trusted public CA, to avoid any warnings during connections.

More about certificates in RDS, please refer to this article:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn781533(v=ws.11)

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Karlie