Server 2008 R2 RDS Gateway certificate renewal, replaced certificate not being picked up

hello,

we updated our ssl certificate our rds system (consisting of single rds server including gateway web access , host roles), configured in iis , rdgateway configuration.  iis works fine, certificate picked browsers accessing ssl version of web access site, checking certificate information in address bar checks out ok.  can demonstrated going https://mercury.counterpointeurozone.com/rdweb/pages/en-us/login.aspx.

the problem access published applications web access (i might add using clients updated rdc7, , in instances of xp sp3 have credssp patch installed) certificate warning, pointing random auto-generated internal certificate have not explicitly created.

the frustrating thing have wiped certificates out using cert mmc, , installed our certificate, upon accessing application self certified certificate auto-created (if doesnt exist) , uses it.  have tried disabling uses of certificate once it's been created still ends using it.

this worked fine before swapped certificates, did add new one, redirect iis , rdgateway use new 1 (in varying combinations, allowing rdgateway automatically configure iis prompted).

short of rebuilding server, isnt option, i'm unsure should doing. certificate we're contains private key, there no reason why shouldnt picked up.

kind regards,

ross harvey

hi ross,

 

according post, issue occurs on program of remoteapp when try access. if misunderstand it, please correct me.

 

as far know, when access program of remoteapp, process following:

 

rd web access->rd session host->remoteapp manager

 

in case, think certificate misconfigure on rd session host server. default, system use “auto generated” certificate created local server. i’d perform following steps check certificate if installed correctly.

 

you need install , choose same certificate on several places including rd session host server, rd web access, rd gateway server, remoteapp manager.

 

1.       start importing ssl certificate computer account.  mmc (add/remove snapins - certificates -computer account).  imported cert pesonal , remote desktop stores.

 

2.       import ssl certificate iis.  run iis manager, select servername (left side connections), under iis section, open server certificates, import ssl certificate here.  select web site (left side connections), open bindings (on right side actions) , associate/bind wildcard cert appropriate https,host,port(443).

 

3.       ts remoteapp manager, overview section, digital signature settings, change, digital signature, sign digital certificate checked change, select ssl certificate.

 

4.       ts gateway manager, select servername, properties, ssl certifcate tab, select existing certificate ssl encryption (recommended), browse certificates, select ssl certificate.

 

5.       terminal services configuration, connections area, select appropriate connection, properties, general tab, select, select ssl certificate.

 

meanwhile, certificates rd gateway must meet these requirements:

 

·         the name in subject line of server certificate (certificate name, or cn) must match dns name client uses connect rd gateway server, unless using wildcard certificates or san attributes of certificates. multiple cns not supported. if organization issues certificates enterprise certification authority (ca), certificate template must configured appropriate name supplied in certificate request. if organization issues certificates stand-alone ca, not need this.

·         the certificate computer certificate.

·         the intended purpose of certificate server authentication. extended key usage (eku) server authentication (1.3.6.1.5.5.7.3.1).

·         the certificate has corresponding private key.

·         the certificate has not expired. recommend certificate valid 1 year date of installation.

·         a certificate object identifier (also known oid) of 2.5.29.15 not required. however, if certificate plan use contains oid of 2.5.29.15, can use certificate if @ least 1 of following key usage values set: cert_key_encipherment_key_usage, cert_key_agreement_key_usage, , cert_data_encipherment_key_usage.

·         the certificate must trusted on clients. is, public certificate of ca signed rd gateway server certificate must located in client's trusted root certification authorities store on client computer.

 

hope helps.

 

Windows Server  >  Remote Desktop Services (Terminal Services)