Ssl – Install SSL certificate for RDP on Windows 2003

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

Your cert is either not importing correctly (so that it is associated with its private key), or it's in the wrong place, or it's not the right type of cert.

If you are installing it correctly the properties will tell you that it is associated with it private key, you will also see the key overlay on the cert icon indicating the same thing. If you're not seeing that then it isn't going to work.

As far as location is concerned it should be in the Personal Certificate store for the machine not the user. The correct way to import it so that it goes in the right place is to open the MMC as administrator, add the Certificates plug in and select the option to use the computer account. Then select the personal store, right click, All Tasks and then import from there.

However it seems most likely to me that the certificate does not have the correct Extended Key Usage OID value in the EKU list. For a certificate to be used for RDP it must have Server Authentication ( 1.3.6.1.5.5.7.3.1 ) somewhere in the list. This is mentioned as the required OID in this Technet article that expands on the requirements for TS certificates in a bit more detail.

There is also a chance that you may have problems if the server name does not match the certificate name - I can't find anything that says they must match but it wouldn't surprise me if they had to.