Remote Desktop Gateway server is temporarily unavailable after updating SSL Certificate

rdwebremote-desktop-gatewayremote-desktop-servicesreplacessl-certificate

The SSL cert for our RDS Web Gateway expires end of July.

I have already got a replacement SSL for the next year.

However, even though it is the same cert (same subject no SANs) I get a Remote Desktop server is temporarily unavailable error when connecting externally (internal users are fine).

The certificate is correct, is installed fine, with the Private key attached, I have added it to IIS on the Web Gateway server and added to the bindings for SSL (there are no other rogue SSL bindings, I have checked).

I have added it to the SSL settings in RD Manager.

And also added it to the 4 instances in RD Deployment (2x Broker, 1x Web Access, 1x Gateway)

Also added to ISA which handles the auth pass though and DUO 2fa.

Basically, exactly the same as before. (rolled back RD server from backups to double check all settings).

Can get to the Webpage, new certificate displays correctly, passes through the auth via DUO and loads the applications page fine.

However trying to launch any app brings up a:
“Your computer can’t connect to the remote computer because the Remote Desktop Gateway server is temporarily unavailable.”

Interestingly, a domain admin CAN connect to the apps, but no standard user can.

To prevent disruption of service, I rolled everything back to the old certificate and it works fine – except on the laptop where I tested the new certificate.
A standard user can now no longer access the applications, but again an admin can. I even tried completely removing the user profile and reloading, and still get the same error – the same user can access it from any other laptop fine.

Another user who launched RD INTERNALLY while I was testing the new cert, now also gets the same error even after the rollback.

So it’s not a profile issue, seems to be something on the individual computer – like the new cert is still in place preventing the application loading – but I’ve been through all certificate stores on the machine and can’t see it added to any store, nor does a “Clear SSL State” work in IE.

I googled lots on the error, and other than checking that the private key is attached (it is) there are lots of examples of the error with no solutions attached.

Any help greatly appreciated.

EDIT:

Going through the rolled back currently working server (with expiring certificate) I noticed that the SSL Certificate part of RD Manager has no certificate installed:
Current RDWeb server

No idea how this was managed (I inherited this RD server from a previous admin).

The Certificate IS installed in RD Deployment (2x Broker, 1x Web Access, 1x Gateway).

If I try and install the new Certificate ONLY to the Deployment area then it autopopulates the RD Manager above with the new SSL.

What I'm thinking is, because ISA is actually serving the web page and handling auth, the client sees the SSL served by ISA and can access a C.A to verify the Cert. But when ISA hits the RDWeb server – if it has that Cert installed in RDManager – ISA itself has no access to go and verify with a C.A – thus causing the problem.

So – How can I try add the Cert to the Deployment WITHOUT adding it to RD Manager?

Thanks.

Best Answer

After reading much documentation found out what I had done wrong. I had broken everything by manually adding the new Cert to IIS myself on the RDWeb server. No idea why this broke everything.

The correct method apparently is to just add the Certificate to the Deployment Configuration via Server Manager (to each of RDWeb, Gateway, Broker etc) and this auto-populates IIS with the new Certificate.

Once done this way, all ways fine.

I still have an issue with clients that had connected when the setup was in fault. Seems to be something in their DUO profile - am working with DUO to resolve, will update with more once I have it.

Thanks.

Edit:

Well, got nowhere with DUO finding what had killed this client, but a rebuild resolved the issue anyway, so definitely something clientside and not related to DUO or the RD Profile.

Related Solutions

Remote Desktop Services Gateway Issue

One possible cause of the issue:

Internally, I have a secondary forward-lookup zone called domainname.net with an A record gateway pointing to the local IP of the gateway server.

This. Don't do this. Lose that DNS record. You aren't supposed to mix internal and external DNS zones, and RDS Gateway is designed to work with that rule. In the Remote Desktop client, set the gateway server to domainname.net, then in the host you're connecting to, use the internal DNS name of the server.

As an aside,

I have the necessary web access config in our sonicwall tz210 (https and rdp, external ip pointing to local ip of rds server)

You don't need the RDP port (TCP 3389) open at all. All traffic goes over 443 if you're using RDS Gateway.

RDP – Configure Custom SSL Certificate for RDP on Windows Server 2012 and Later

It turns out that much of the configuration data for RDSH is stored in the Win32_TSGeneralSetting class in WMI in the root\cimv2\TerminalServices namespace. The configured certificate for a given connection is referenced by the Thumbprint value of that certificate on a property called SSLCertificateSHA1Hash.

UPDATE: Here's a generalized Powershell solution that grabs and sets the thumbprint of the first SSL cert in the computer's personal store. If your system has multiple certs, you should add a -Filter option to the gci command to make sure you reference the correct cert. I've left my original answer intact below this for reference.

# get a reference to the config instance
$tsgs = gwmi -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'"

# grab the thumbprint of the first SSL cert in the computer store
$thumb = (gci -path cert:/LocalMachine/My | select -first 1).Thumbprint

# set the new thumbprint value
swmi -path $tsgs.__path -argument @{SSLCertificateSHA1Hash="$thumb"}

In order to get the thumbprint value

Open the properties dialog for your certificate and select the Details tab
Scroll down to the Thumbprint field and copy the space delimited hex string into something like Notepad
Remove all the spaces from the string. You'll also want to watch out for and remove a non-ascii character that sometimes gets copied just before the first character in the string. It's not visible in Notepad.
This is the value you need to set in WMI. It should look something like this: 1ea1fd5b25b8c327be2c4e4852263efdb4d16af4.

Now that you have the thumbprint value, here's a one-liner you can use to set the value using wmic:

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"

Or if PowerShell is your thing, you can use this instead:

$path = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").__path
Set-WmiInstance -Path $path -argument @{SSLCertificateSHA1Hash="THUMBPRINT"}

Note: the certificate must be in the 'Personal' Certificate Store for the Computer account.

Best Answer

Related Solutions

Remote Desktop Services Gateway Issue

RDP – Configure Custom SSL Certificate for RDP on Windows Server 2012 and Later

Related Topic