Renewing SSL certificates for RDS deployments when they expire
Prior to beginning, you'll need the new .pfx file and password for the renewed SSL certificate. You can find more details about exporting to .pfx here.
Before anything, you have to make sure you have all the servers in the deployment on the broker. Head to the top right and select "Manage" then "Add Servers"
In the add servers dialogue, no need to type anything just click "Find Now" and it will load all the servers in the domain.
Select any in the list, then press CTRL+A [MACs would be Command+A] to select them all then hit the arrow in the middle of the two boxes and choose OK.
Server manager will take a bit to load all the information and refresh. Once completed head to "Remote Desktop Services" on the left side.
Then go to "Collections"
And then on the far right, you'll hit "Tasks" then "Edit Deployment settings"
Now select Certificates on the left to get to the "Manage Certificates" Section.
Here we have the 4 services that work off the SSL certificate. You'll have to do the following steps for EACH of the 4 services to update them.
Select any of the 4, then choose "select existing certificate..."
You'll use the second section "Choose a different certificate"
Browse to the certificate and then enter the password. Make sure to check off the last option and hit OK.
You'll be back at the Deployment Options screen, hit Apply at the bottom right, let it load and repeat for the new 3 services. Once done Hit apply one last time and then OK.
CREATE A NEW CERTIFICATE REQUEST:
- Launch IIS Manager and click the SERVER name [not the websites or virtual directories]
- In the IIS section, click SERVER CERTIFICATES [if you don’t see this, you are likely not at the server level, go click on the server name at the top of the IIS Manager CONNECTIONS tree]
- Click CREATE CERTIFICATE REQUEST and complete the form. Note that the only things that really counts is the certificate name [like tsg.commodore.ca] and company information.
- Click NEXT and on the CRYPTOGRAPHIC screen, leave the default MICROSOFT RSA… provider option but you mush change the BIT LENGTH to 2048.
- Specify a path for the CSR. I like C:\ but it realy make no difference.
SUBMIT YOUR CSR AND GET A NICE NEW CERTIFICATE:
- Surf on over to GODADDY.COM or your favourite provider.
- Pay them for the cert
- Submit the CSR.
- Wait for an approval request email from GoDaddy [or whoever you used].
- Click the link in the approval request email and approve the request.
- Wait anywhere from 2 minutes to 2 hours and check your GoDaddy account for the new cert then download it to your server.�
- Perhaps everyone does this but I no for sure that GoDaddy will take your new cert dates and extend them by the amount of time left on your exisiting cert. For example. If you buy a new 3 year cert and your current cert expires in two months, GoDaddy will give you a new cert which expires in t 3 years and two months.
- GoDaddy will give you two certs: 1: your cert 2: an intermediate cert. If this is a renewal, you can ignore the intermediate cert because you already installed in when you installed your first cert.
- If you have any questions, call GoDaddy at 480 505 8877 any time day or night, they are awesome. [And no, GoDaddy does not pay me anything… I just like them.]
INSTALL A CERTIFICATE ON THE TS/RD GATEWAY SERVER:
- Open the Certificates snap-in console. If you have not already added the Certificates snap-in console, you can do so by doing the following:
- Click Start, click Run, type mmc, and then click OK.
- On the File menu, click Add/Remove Snap-in.
- In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, click Certificates, and then click Add.
- In the Certificates snap-in dialog box, click Computer account, and then click Next.
- In the Select Computer dialog box, click Local computer: [the computer this console is running on], and then click Finish.
- In the Add or Remove snap-ins dialog box, click OK.
- In the Certificates snap-in console, in the console tree, expand Certificates [Local Computer], and then click Personal.
- Right-click the Personal folder, point to All Tasks, and then click Import.
- On the Welcome to the Certificate Import Wizard page, click Next.
- On the File to Import page, in the File name box, specify the name of the certificate that you want to import, and then click Next.
- On the Password page, do the following:
- If you specified a password for the private key associated with the certificate earlier, type the password.
- If you want to mark the private key for the certificate as exportable, ensure that Mark this key as exportable is selected.
- If you want to include all extended properties for the certificate, ensure that Include all extended properties is selected.
- Click Next.
- On the Certificate Store page, accept the default option, and then click Next.
- On the Completing the Certificate Import Wizard page, confirm that the correct certificate has been selected.
- Click Finish.
- After the certificate import has successfully completed, a message appears confirming that the import was successful. Click OK.
- With Certificates selected in the console tree, in the details pane, verify that the correct certificate appears in the list of certificates on the TS Gateway server. The certificate must be under the Personal store of the local computer.
MAP A CERTIFICATE TO THE LOCAL TS / RD GATEWAY SERVER:
- You must use TS Gateway Manager to map the TS Gateway server certificate. If you map a TS Gateway server certificate by using any other method, TS Gateway will not function correctly.
- Open TS Gateway Manager. To open TS Gateway Manager, click Start, point to Administrative Tools, point to Terminal Services, and then click TS Gateway Manager.
- In the TS Gateway Manager console tree, right-click the local TS Gateway server, and then click Properties.
- On the SSL Certificate tab, click Select an existing certificate for SSL encryption [recommended], and then click Browse Certificates.
- In the Install Certificate dialog box, click the certificate that you want to use, and then click Install.
- Click OK to close the Properties dialog box for the TS Gateway server.
- If this is the first time that you have mapped the TS Gateway certificate, after the certificate mapping is completed, you can verify that the mapping was successful by viewing the TS Gateway Server Status area in TS Gateway Manager. Under Configuration Status and Configuration Tasks, the warning stating that a server certificate is not yet installed or selected and the View or modify certificate properties hyperlink are no longer displayed
We had a customer report an issue with a hosted server last night. They were trying to RDP in to a hosted Windows Server 2008 machine from Vista PC’s and we’re not able to. XP clients were fine. Here’s the error they got:
“Remote Desktop cannot connect to the remote computer because the authentication certificate received from the remote computer is expired or invalid”.
Windows is trying to make RDP secure, doing all sorts of mutual authentication things with x.509 certificates. The solutions I first saw were to renew a certificate from the PKI. Huh? This is a workgroup machine in an isolated/firewalled network. No go there sunshine!
The solution was to fire up the Certificates snap-in in MMC on the server for the local computer, browse to Remote Desktop and delete the certificate. This was because the cert was expired.
Alternatively you can change the security of RDP from “SSL [TLS 1.0]” or “Negotiate” to “RDP Security Layer” to instruct RDP to abandon the certificate. This is done in the properties of RDP in the Terminal Services Configuration MMC.
If the cert wasn’t expire then you should check that the time was correct on both the client and the server.