Home / server / Questions / 641055
Accepted
Gabor Garami
Asked: 2014-10-31 21:11:45 +0800 CST

RDweb certificate issue

  • 772

I have a problem with the following system:

  • There is a Windows 2012 R2 TS farm with 2 node, a gateway and a broker
  • It's available externally from login.example.com
  • There is an AD too, the TS farm servers are member servers, the AD domain is example.local

The problem: I would like to allow users to access this system without any warning or any certificate installation requirements. The computers are non-AD computers and there is no way to make them AD-member.

Things what i tried or thinked around:

  • I tried to get a free StartSSL certificate to login.example.com but after I installed it, the TS session starting broke because name mismatch.
  • I tried to make a selfsigned certificate that was issued to tsgw.example.local but the problem was opposite: even if I installed the cert, browsers complained about name mismatch.
  • As I know, there is no public CA what allow to issue a cert with public common name, but a private altname/additional DNS name.
  • The forums / SO/SF topics what I discovered are recommends to make a private CA and issue a cert with that (it's able to issue cert to both name) but it's our last plan, because we really don't want to force users to install a CA certificate to use our service (as they're non-AD computers, there is no automatic way to enforce trusting our CA) if there is a way to avoid that.

Is there any solution for this problem? I would like be satisfied if there is a way to enforce RDweb to ignore name mismatch.

windows-server-2012-r2

2 Answers

  1. Best Answer

    The solution was easier than I expected. You have to navigate in Server Manager to a Remote Desktop management interface, edit deployment properties and change all certificates in "Certificates" tab to the external certificate. In inter-server communication the services do not use an SSL-encrypted connection (just pure RPC), so they can simply ignore the certificate you install. However, in the client-server communication, this certificate will be used, so it's very important to be same in all cases.

    • 1

  2. Why can't you buy an SSL cert from an authority? I was configuring a similar setup recently and I both one from here: https://www.namecheap.com/ It's called PositiveSSL and costs around $6. After your server is configured with this one you won't get an SSL error.

    • 0