[Forum FAQ] How to setup Self-Signed Certificate for RDS RRS feed

  • General discussion

  • Everyone knows that certificate are most important for RDS server connections. Whenever we deploy the Server environment, servers need certificate for trusts. Whenever we are browsing any https site, it requests the certificate information. After getting trusted by the certificate, it’s getting access to browse sites. When we browse RD Web site, it also needs certificate.

    Generally in production environment, we use wild card certificate or SAN certificate and use a Self-Signed Certificate only for testing and evaluation purposes. We can obtain certificate by generating and submitting a certificate request to obtain a certificate from a stand-alone or an enterprise certification authority (CA) or purchase certificate from one of trusted public CAs that participate in the Microsoft Root Certificate Program Members program. When we buy a certificate from a public provider, the Root and Intermediate certificates are already located in the computers Certificate Store. (Trusted Root Certification Authorities). Which means that the computer already trusts the provider of the certificate and therefore your certificate is also trusted. But this does not the case with Self-Signed certificate and thus we can’t use it in production environment and only used for testing.

    Suppose we brought Wildcard certificate with RDS farm name “*”. It means that it can be used for “,, etc.” for all different RDS roles (RDCB, RDG, RDWA). However, when we create a self-signed certificate, it only can use specific names such as “”. Therefore, with Wildcard certificate, we can manage the production RDS server environment with single certificate.

    When we need to test or evaluate RDS, we can use a Self-Signed certificate. We can create it during the configuration for certificate of RDS server and we can also create the Self-Signed certificate from IIS manager. Here, we will introduce how to create a Self-Signed certificate from IIS manager and then how to use for RDS environment.

    Please follow the following steps:

    1. Click on Search and type IIS Manager (Figure 1)

    Figure 1

    2. It will open IIS Manager Dialog Box (Figure 2)

    Figure 2: IIS Manager

    3. In Features view, double-click Server Certificates. (Figure 3)

    Figure 3: Server Certificate

    4. In the Actions pane, click Create Self-Signed Certificate. (Figure 4)

    Figure 4: Select option for creating certificate

    5. On the Create Self-Signed Certificate page, type a friendly name for the certificate in the “Specify a friendly name for the certificate” box. For the RDS setup “Specify the certificate store as “Personal” and then click OK. (Figure 5). Because the certificate must be stored under “Local Computer\personal certificate Store”.

    Figure 5: Specify Friendly Name

    6. After creating the certificate, we need to export the certificate and then, we will assign it to RDS deployment. We can export with the help of Export option as per below image. (Figure 6)

    Figure 6: Export

    7. Specify the path where you want to export the certificate. Please remember that certificate is exported in .pfx file format. (Figure 7)

    Figure 7: Specify the path

    8. When we export the certificate, we need to provide a password for your certificate (Figure 8).

    Figure 8: Export Certificate Procedure

    9. Exported Certificate (Figure 9)

    Figure 9: Exported Certificate

    10. Before applying to the RDS deployment, we need to check whether the certificate is stored under Trusted Root certification Authorities.

    Open MMC > Add\Remove Snap in > Certificate > Add it and specify the path and we can see below display page. Where we can see the certificate is listed under “Trusted Root certification Authorities” with its private key (Figure 10). Please make sure that the certificate has attached private key.

    Figure 10: Trusted Root certification Authorities

    11. Now, we can assign the created certificate under RDS deployment by Edit Deployment properties (Figure 11)

    Figure 11: Deployment Properties

    12. In the certificate tab, we can manage our RDS certificate. In this demo, we choose “Select existing Certificate”. (Figure 12)

    Figure 12: Select Certificate

    13. After selecting that option, one dialog box will appear and we need to specify the path where certificate is stored, specify the password. We know that it is signed by trusted root but still need to select the checkbox for allowing the certificate to store under trusted root certification authority. (Figure 13)

    Figure 13: Specify path and password for certificate

    14. Select the certificate and click Apply. It will display “Ready to apply” (Figure 14)

    Figure 14: Applying Certificate to RDS

    15. After selecting certificate and applying, we can see that it’s assigned to RDCB. In the same manner, we need to select the same certificate for all the Role Services by selecting “Selecting existing certificate” option (Figure 15)

    Figure 15: Certificate assigned to RDCB-Enable Single Sign

    16. After performing all the required steps, we have done with certificate works on server side. However, Remote Desktop Services clients also must have the certificate from an enterprise certification authority (CA) that issued the server certificate in their Trusted Root Certification Authorities store. Therefore, if we create a self-signed certificate, we must copy the certificate to the client computer (or to a network share that can be accessed from the client computer) and then install the certificate in the Trusted Root Certification Authorities store on the client computer.

    In addition to this, you can refer to following articles for more information on certificates for RDS. RD Gateway also needs SSL certificate signed by trusted authority to connect internal networks through RD Gateway.

    RDS: The RD Gateway server must be configured to use a valid SSL certificate

    Certificate Requirements for Windows 2008 R2 and Windows 2012 Remote Desktop Services

    Minimum Certificate Requirements for Typical RDS implementation

    Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

    Monday, June 9, 2014 5:34 AM