Security – How to configure Remote Desktop Session Host Server to use 3rd party CA and certificates

certificate-authorityrdpSecurity

I'm trying to harden our RDP service so we can use a specific server without having to VPN into our network. I would like the RDP Session Host Server to use certificates from an authorized certificate authority like Verisign or RapidSSL. I can't seem to find any good tutorials covering this, if it's even possible. Right now we use the default self-signed certificate provided. When I choose 'Select', only the default self-signed cert is displayed. No other options. I'm not quite sure how to add our CA cert from our official cert authority. Is there a way change configure this for a 3rd party CA Cert?

enter image description here

Also, for encryption level, is it more secure to set this to high or FIPS compliant? If you think it's unwise to expose the RDP service, please share.

Any info is greatly appreciated.

Thanks!

I guess I should add this server is also a member of an Active Directory Domain.

Best Answer

You should expose only your RD Gateway (port 443) to the internet, not the session host.

enter image description here

To import new certificates for RDS to use, you need to import/install them first into the certificate store.

You might want to read this two-part tutorial. Yes, I'm sorry, it is a plug. But I also really think it could help:

http://www.myotherpcisacloud.com/post/2011/11/23/Remote-Desktop-Services-Tutorial-1-(RD-Gateway).aspx

http://www.myotherpcisacloud.com/post/2011/11/25/Remote-Desktop-Services-Tutorial-2-(RD-Web-Access).aspx

Related Solutions

Deploying internal certificate via GPO – will this only work for IE

It will make Windows any clients joined to your domain trust your certificate authority as a Trusted Root CA, so any certificates your CA issues are automatically trusted by your computers. Anything that asks Windows if a certificate is trusted will trust the root certificate, but not all browsers do this.

For example, Internet Explorer will trust the certificate, as will Outlook (for example an Exchange AutoDiscover certificate) however Firefox does not trust the certificate and holds its own list of trusted certificates. It all depends on individual browser implementation I'm afraid.

Normally you can import trusted root certificates into an application if it uses its own list of trusted certificates, but again this is implementation dependant.

Apache – Client Certificate Authentication Guide

sometimes u need to add a SSLCertificateChainFile option in your apache2.conf.

For example, we use SureServer for our SSL certificates. Sometimes browsers to not contain the full tree for the SSL certificate andu need to supply the missing piece:

SSLEngine On
SSLCertificateFile ...
SSLCertificateKeyFile ...
SSLCertificateChainFile /etc/apache2/sureserverEDU.pem

So u probably need to add your 3rd party CA there.

If I recall correctly rapidSSL has a chain file (RapidSSL_CA_bundle.pem)

Best Answer

Related Solutions

Deploying internal certificate via GPO – will this only work for IE

Apache – Client Certificate Authentication Guide

Related Topic