Wmic: error when setting remote desktop self-signed certificate

remote desktopssl-certificatewindows-server-2012-r2

I'm attempting to use the wmic approach of assigning a self-signed certificate for Remote Desktop use on a Windows Server 2012 VM as described here and here.

The CA for the RDP certificate has been installed under Local Machine > Trusted Root Certification Authorities and the RDP certificate itself has been installed under Local Machine > Remote Desktop.

When I attempt to issue the wmic command to use the imported RDP certificate, I receive the following error:

C:\Windows\system32> wmic /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="3c7a7a78af9699b69182dff15329834113a518b3"
Updating property(s) of '\\SERVER\root\CIMV2\TerminalServices:Win32_TSGeneralSetting.TerminalName="RDP-Tcp"'
ERROR:
Description = Invalid parameter

…I also tried importing the RDP certificate under Local Machine > Personal, but the error message remains unchanged.

Best Answer

Stuck with the same issue for 3 hours, but found the root of the problem. In my case the reason for "Invalid parameter" error was that I've mistakenly imported a certificate without a corresponding private key.

So make sure, that when you open your certificate in General tab you see in the last line a key symbol and the text "You have a private key that corresponds to this certificate." Certificate with private key

It's quite easy to combine certificate and a key into pfx file. Have a look here https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/

Related Solutions

Using CA Certificate for Remote Desktop – Secure RDP Connection Guide

The question you found that mentions using wmic to set the certificate thumbprint value should work without any additional feature installation. I asked and answered a similar question here with a little more detail. It also has a PowerShell equivalent for the wmic command. But I'll add some more explanation here as well.

Since you're already using this certificate for MSSQL SSL, I assume it's already installed into one of the certificate stores on the system. If you installed it in the context of a service account that MSSQL is running as, you might also need to install it into the Personal or Remote Desktop store for the "Local Computer" as well.
enter image description here

Once it's in there, you just need to update the SSLCertificateSHA1Hash value in Win32_TSGeneralSetting to point to it using one of the commands in my previous question.

If you want to check what the value is currently set to and compare it to the self-signed certificate, you can change the wmic command to the following. You can also use this to validate that the new thumbprint value you tried to set is correct.

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Get SSLCertificateSHA1Hash

The output should look something like this:
enter image description here

Why is Windows 2012 R2 not trusting the self-signed certificate

The error you are receiving is not that it is not a trusted root certificate, but that it is not able to verify up the chain to a trusted certificate. If any part of the chain is broken, untrusted, or missing, you will receive such an error. The error that I get with an untrusted, self-signed root is this: This CA root certificate is not trusted. To enable trust, install this certificate in the Trusted Root Certification Authorities store. But for you, it says it cannot verify up to a trusted root certificate. This may be that during the self-signing process, you may have told openssl to sign the certificate with a different root (not self-sign), or it may not have been set as a root CA. If it's the first, you must trust the root it was signed with instead. If it's the latter, it's a matter of setting a few properties in openssl.conf.

Best Answer

Related Solutions

Using CA Certificate for Remote Desktop – Secure RDP Connection Guide

Why is Windows 2012 R2 not trusting the self-signed certificate

Related Topic