Join Log in
Score:0
JackWrighty avatar Server

Remote Desktop Gateway (RDG) Public CA certificate not trusted on external connection

cu flag
JackWrighty

Currently moving RDG role from "nene-server" to "NTRDG01, but when trying to connect externally to the gateway, getting certificate error:External error on gateway over https. This was weird because I uploaded a re-keyed certificate from 123reg but the server didn't seem to want to serve it up, so I used the below command to try to force it:

WMIC /namespace:\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="CERTIFICATE THUMBPRINT HERE".

This resulted in the server using the new certificate, but still erroring:Correct certificate failing

This is the method I used to re-key the existing wildcard certificate:

  1. Generated CSR & Private key OpenSSL> Req -newkey rsa:2048 -keyout "C:\cert\private.key" -out "C:\cert\request.csr" Generating CSR & key
  2. Re-keyed the existing Wildcard SSL certificate in 123reg
  3. Downloaded 123reg certificate bundle in type "IIS", this provided a .pem, .p7b & .crt
  4. Then bundled the .crt & private key into a .pfx for the gateway import OpenSSL> pkcs12 -export -out "C:\cert\bundle.co.uk.pfx" -inkey "C:\cert\private.key" -in "C:\cert\cert.crt" Bundling certificate & key
  5. I then uploaded this new .pfx cert bundle directly into the RDG RDG SSL cert uploaded

However if I try to use the gateway externally it errors showing image 2. I've tried this a few times, but I notice when uploading a new certificate the certificate being served externally doesn't update to match the RDG uploaded one for example:

This is the validity timestamp on one of my attempts (12:59:34):old cert timestamp This is the validity timestamp on the latest attempt (15:17:00):new cert timestamp

Am I generating the certificate incorrectly? This is how I did it previously (without the re-key), Is there something wrong with my RDG? ( I spun this VM up fresh & only domain joined it before configuring the gateway)

Any help would be really appreciated, I feel like hitting my head against a wall !

66
0 + 1
br flag
garethTheRed
Did you add a Subject Alternative Name (SAN) to the certificate? Adding the FQDN to the Subject field is pointless as most clients ignore that and instead expect to read the FQDN from the SAN these days.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.