Remote Desktop Service Certificate

Question

I have a high availability RDS implementation that is up and running with 2 servers, each running the connection broker.

When my users connect, they receive a certificate warning with the name of the server they are connecting to.

My domain controller is setup as a certificate authority.

How to I create a certificate for the "cluster" so the users no longer receive the certificate warning and no longer have to install the certificate.

My understanding is that the certificate should be named after the cluster and contain the names of the 2 servers.
In the server manager deployment properties, I am able to create a certificate but it does not work correctly.

Please advise on how to create and publish the certificate.

Thanks in advance

Answer 1

Hello Joshua,

Thank you for your question and for reaching out with your question today.

To create a certificate for your RDS cluster that includes the names of the two servers and eliminate the certificate warning for your users, you can follow these general steps:

1. Request a certificate from your domain controller:
   • Open the Certification Authority console on your domain controller.
   • Right-click on "Certificate Templates" and select "Manage."
   • Duplicate an existing certificate template (e.g., "Computer") to create a new template.
   • Configure the new template to include the names of your RDS servers as Subject Alternative Names (SANs).
   • Publish the new certificate template.
2. Issue the certificate for the RDS cluster:
   • Open the Certification Authority console on your domain controller.
   • Right-click on "Certificate Templates" and select "New" and then "Certificate Template to Issue."
   • Select the certificate template you created in the previous step.
   • Provide the necessary information, such as the certificate validity period.
   • Issue the certificate.
3. Install the issued certificate on each RDS server:
   • On each RDS server, open the Microsoft Management Console (MMC) and add the "Certificates" snap-in for the local computer account.
   • Navigate to "Personal" -> "Certificates."
   • Right-click on "Certificates" and select "All Tasks" -> "Import."
   • Follow the import wizard to import the issued certificate.
4. Configure the RDS deployment to use the new certificate:
   • Open the "Server Manager" on one of the RDS servers.
   • Navigate to "Remote Desktop Services" -> "Deployment Overview."
   • In the "Deployment Properties" section, click on "Edit Deployment Properties" on the right-hand side.
   • Go to the "Certificates" tab.
   • Select the newly imported certificate from the list of available certificates.
   • Click "OK" to save the changes.

After completing these steps, the RDS cluster should be using the newly created certificate, which includes the names of both servers as SANs. This should prevent your users from receiving certificate warnings when connecting to the RDS cluster.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.