How install SSL certificate for RDS on windows server 2016?

Question

I installed windows server 2016 for a small company, so I don't need to have domain controller on this installation and for RDS I only need RD Licensing and RD Session Host roles. But only with that roles theres is no Remote Desktop Gateway which is used in many tutorials to install SSL certificate on terminal server (like here: https://ryanmangansitblog.com/2013/03/27/deploying-remote-desktop-gateway-rds-2012/).

So to conclude, I just don't have interface of Remote Desktop Gateway to install SSL certificate.

Is there any workaround to deal with it and install SSL cert on my RDS?

Solution 1

Finally I found solution!

1. First of all, name of the server had to be changed by adding DNS suffix. For example, if you want to connect to the server by srv.example.com address, your server name should be "srv" and DNS suffix "example.com". It can be done in computer properties.
2. Then setup licensing in "RD Licensing Manager"
3. Now issue certificate to domain name srv.example.com (i.e. in Let's encrypt)
4. Convert let's encrypt cert files into windows one via: openssl pkcs12 -export -out certificate.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem (Linux command) if you issued certificate with help of acme.sh, you command should look like: openssl pkcs12 -export -out certificate.pfx -inkey yourdomain.com.key -in yourdomain.com.cer -certfile fullchain.cer
5. Install converted certificate to personal store at the computer level. Not at user level
6. Then with this command display the thumbprint of the certificate, copy it to a text file or something similar: Get-ChildItem "Cert:\LocalMachine\My"
7. This is a variable to set the WMI path to the RD Session Host RDP listener (Where the certificate needs to be changed): $PATH = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices)
8. Finally this is the command to change the active certificate on the RDP listener: Set-WmiInstance -Path $PATH -argument @{SSLCertificateSHA1Hash="thumbprint"} The "thumbprint" above, is the value you noted earlier, just insert it between the ".
9. Well done! Now you have RDP server with custom SSL cert without installing RD Gateway Credits

Solution 2

Launch certlm.msc and import the cert into the "Personal -> Certificates" store. After it's installed, launch Server Manger and select the Remote Desktop role icon on the left. click the "Tasks" dropdown in the "Deployment Overview" section, then click "Edit Deployment Properties" in the context menu that appears. You'll be able to assign the certificate you imported to roles by clicking the "Select existing certificate" button.

You should still configure the certificate settings whether or not you have the Gateway role installed.

Solution 3

Partly solution with the help of MS community I have found there: https://www.risual.com/2014/03/10/setting-up-a-2012-r2-rds-gateway-for-a-workgroup/. Summary to this article: to make license server issue certificates just to the Internet address like that srv.example.com instead of only "example" (computer name) the DNS suffix should be added in computer properties:

By the way, the problem still exists in the way that the server for RDP connections still uses self-issued certificate (even If I am deleting it and leaving only let'sencrypt cert). On each RD services restart it issues new one instead of using mine. How can I make it to use lets encrypt cert?

Of course, I know, that I can export public key for self-generated cert and add it to employee's PCs, but it is not good solution in my opinion.

Comments

[Bogdan Lashkov]

Hi! Thanks for reply! I don't have "Deployment Overview" interface as I don't have domain role on my server and I don't need it: i.imgur.com/qYGCbpI.png

[Ricky]

Thank you very much! I followed steps 1, 5, 6, 7, 8 and it worked! By the way, step 8 needs administrator privilege to run.

[Radu C]

I had Invalid parameter with these instructions. After a lot of random poking, I got this to work. Instead of the -Path parameter I used the -InputObject parameter and then it worked.

[Radu C]

This answer assumed you have the Remote Desktop Services role installed, which is a paid extra for more complex setups.