Single *.company.com wildcard cert for RDS Deployment possible

Apparently MS botched the instruction somewhat.

I believe you need to create the cert request in iis manager on the rdg gateway computer. The request needs to specify the fqdn used by the clients to connect over the internet. For processing the request signing you use a CA trusted by your client computers. If you have full control over the client computers you can use your own CA, as long as they trust your CA root certificate. Otherwise use a commercial CA such as Verisign, Thawte or such. After importing the signed cert to iis it should be available for import to your rdg gateway.

It is all documented in the official guide: http://technet.microsoft.com/en-us/library/dd983941%28WS.10%29.aspx

including the helpful if ranting comment at the bottom of http://technet.microsoft.com/en-us/library/dd983949(v=ws.10).aspx

And except apparently this little detail: http://blog.xiquest.com/2010/01/rd-gatewayweb-access-outside-the-firewall/

"Open up “IIS Admin” console from the “Administrative Tools” menu. Navigate to the default web site and configure the “Application Settings” for “Default Web Site\RDWeb\Pages“. Change the following setting: “DefaultTSGateway” = [fqdn of Internet accessible TS Gateway]

Note: make sure this is also the server name listed on your SSL certificate."

I'll tidy up this post as soon as I get behind a proper computer.

This appears to be persisting. ProTip Kids: make notes!

Set-RDSessionCollectionConfiguration –CollectionName <your collection> -CustomRdpProperty “use redirection server name:i:1 `n alternate full address:s:RDS01.corp.contoso.com”