RDP and RD Gateway: SSL certificate setup

A typical Remote Desktop setup with a gateway has multiple components, each requiring certificates:

Certificate requirements

Without simple-acme, where you install the certificate depends on the setup:

The steps and commands follow Microsoft Learn. Each subsection links to the page it is based on. Replace THUMBPRINT with the certificate's thumbprint and the host names with your own.

1. RDP listener on one server (Win32_TSGeneralSetting)

The RDP listener finds its certificate through the thumbprint in the SSLCertificateSHA1Hash property of the WMI class Win32_TSGeneralSetting in the namespace Root\CimV2\TerminalServices. Microsoft describes this method for a server that is not part of an RDS deployment.

1. 1 Import the certificate with its private key into the Personal store of the computer account (certlm.msc). If it is not there, the command in step 4 fails with Invalid Parameter.
2. 2 Open the certificate, select the Details tab and copy the Thumbprint value. Remove all spaces. On Windows Server 2012 R2 and older the copied value can contain an invisible character; paste it into a command prompt to see it, and remove it.
3. 3 Give NETWORK SERVICE read access to the private key. Remote Desktop runs under that account. In certlm.msc, expand Personal, right-click the certificate, select All Tasks → Manage Private Keys, select Add, type NETWORK SERVICE, select OK, tick Read under Allow and select OK.
4. 4 Set the thumbprint on the listener with Windows PowerShell:

Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices | Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash="THUMBPRINT"}

Run it in Windows PowerShell 5.1 (powershell.exe): Get-WmiObject and Set-WmiInstance were removed in PowerShell 7 (pwsh.exe). On Windows Server 2012 and 2012 R2 Microsoft shows the same change with wmic in a command prompt:

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"

Microsoft lists wmic as deprecated from Windows Server 21H1 and points to PowerShell instead.

Check the result by reading the class with Get-WmiObject alone. SSLCertificateSHA1Hash must show your thumbprint, and SSLCertificateSHA1HashType must be 3 (Custom). 1 means the listener still uses the default self-signed certificate.

Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices

Sources: Remote Desktop listener certificate configurations ↗, Win32_TSGeneralSetting class ↗, wmic ↗, Get-WmiObject (PowerShell 5.1) ↗, Differences between Windows PowerShell 5.1 and PowerShell 7.x ↗ (Microsoft Learn).

2. RDS deployment via Server Manager

In an RDS deployment with RD Connection Broker you set the certificates for the whole deployment. Server Manager imports the certificate on every server in the deployment and binds it to their roles. The certificate must be issued for Server Authentication, be trusted by the servers and the clients, and have an exportable private key. You need it as a .pfx file with the private key and its password.

1. 1 In Server Manager, select Remote Desktop Services in the left pane. On the Overview tab, under Deployment Overview, select TASKS → Edit Deployment Properties.
2. 2 Select Certificates. The table lists the role services: RD Gateway, RD Web Access and the two RD Connection Broker role services (Enable Single Sign On and Publishing).
3. 3 Select a role service, then Select existing certificate. Select Browse, open the .pfx file and enter its password.
4. 4 Tick Allow the certificate to be added to the Trusted Root Certification Authorities certificate store on the destination computers and select OK.
5. 5 Select Apply and wait until the certificate has been applied. Repeat steps 3 to 5 for each role service.

In Microsoft's deployment guide, RD Gateway and RD Web Access use the external FQDN and the two RD Connection Broker role services use the Connection Broker's internal FQDN. After a certificate change you may need to restart the TSGateway service on each RD Gateway server yourself. For the RDP listener on the RD Session Host servers, Microsoft refers to the method in subsection 1.

Sources: Use certificates in Remote Desktop Services ↗, Deploy your Remote Desktop environment ↗, Add high availability to the RD Web and Gateway web front ↗ (Microsoft Learn).

3. RD Gateway Manager

Import the certificate on the gateway server in RD Gateway Manager:

1. 1 In Server Manager, select Remote Desktop Services → Servers. Right-click the server and select RD Gateway Manager.
2. 2 In the left pane, right-click the gateway name and select Properties.
3. 3 On the SSL Certificate tab, select Import a certificate into the RD Gateway and then Browse and Import Certificate.
4. 4 Select the .pfx file, select Open and enter the password. The tab then shows the certificate's details.

Microsoft recommends a publicly issued certificate on RD Gateway, because clients connect from outside. With a certificate from a private CA, every client must trust its chain in advance.

Source: Deploy the Remote Desktop Gateway role ↗ (Microsoft Learn).

4. Set-RDCertificate (PowerShell)

Set-RDCertificate from the RemoteDesktop module imports a certificate, or applies one that is already installed, to an RDS role. Run it in a PowerShell session started as administrator, on a computer with the RDS management tools (RSAT) and the role you are configuring. -Role takes RDGateway, RDWebAccess, RDRedirector or RDPublishing; run the command once for each role you use. Without -ConnectionBroker the cmdlet uses the local computer's FQDN.

Import a .pfx file. Microsoft's example sets RDWebAccess; replace PathToPFXFile with the full path to the file and change Role for the other roles:

$password = Read-Host -AsSecureString -Prompt "Enter Password"
$parameters = @{
  Role        = "RDWebAccess"
  Password    = $password
  ImportPath  = "PathToPFXFile"
}
Set-RDCertificate @parameters

Use a certificate that is already installed (Windows Server 2019 and later). Microsoft's example sets RDRedirector. The certificate must be in LocalMachine\My on every server that runs the role:

Set-RDCertificate -Role RDRedirector -Thumbprint THUMBPRINT -ConnectionBroker "rdcb.internal.com"

Check the result. Get-RDCertificate shows the subject, thumbprint, expiry date and level for each role; a public certificate shows the level Trusted.

Get-RDCertificate -ConnectionBroker "rdcb.internal.com"

Sources: Set-RDCertificate ↗, Get-RDCertificate ↗, Use certificates in Remote Desktop Services ↗ (Microsoft Learn).

A common scenario: RD Gateway and the RDP server use the same public FQDN (e.g. rdp.your-domain.com). The client connects to the gateway via public DNS, and the gateway must forward to the internal RDP server. But the gateway cannot resolve rdp.your-domain.com to the internal server, because public DNS points to the gateway itself.

The solution is a hosts file entry on the gateway server:

# C:\Windows\System32\drivers\etc\hosts on the RD Gateway server
10.0.1.50    rdp.your-domain.com

Now the gateway resolves rdp.your-domain.com to the internal IP (10.0.1.50) and forwards RDP traffic correctly. The client only sees rdp.your-domain.com and does not need to know the internal IP.