Implementing SSL for RDP connection (RDP listener on the RD session host)

hi,

we have win2008 r2 server rd session host role. accessible rdp public internet under globally-visible dns name in .com domain. server member of active directory domain (dns suffix domain internal, non-public-visible, ending .local ).

now implement ssl certification rdp server, clients connecting outside not certificate warning on connect.

by mean of iis7, created certificate signing request external dns name of server, , signed @ alphassl free/trial certificate valid 45 days. completed certificate signing alphassl reply, , installed certificate iis7. can access external dns name https iis7 default page, , browsers site trusted. certification path starts globalsign, under alpha ca, under our cert domain.

next step, trying install same certificate in properties of rdp-tcp connection of rd session host, instead of auto-generated cert. there default. on clicking 'select', allows pick certificate list (its eku attributes 'server authentication (1.3.6.1.5.5.7.3.1) , client authentication (1.3.6.1.5.5.7.3.2)') , shows active. then, on connection attempt rdp client (usual mstsc included windows 7 prof.), warning "the certificate not valid usage".

then re-tried, having got free/trial certificate same dns name comodo/essentialssl (or instantssl). certification path bit longer : usertrust/comodoca/essentialssl ca/our one. eku contains : server authentication (1.3.6.1.5.5.7.3.1), client authentication (1.3.6.1.5.5.7.3.2), unknown key usage (1.3.6.1.4.1.311.10.3.3) , unknown key usage (2.16.840.1.113730.4.1). used same iis7 dialogs create/complete certificate request. , yes, cert. possible assign rdp-tcp connection, still not valid rdp-tcp usage.

now want ask experts, doing wrong, details overlook , have in different, correct way, obtain certificate usable rdp , signed known ssl trust vendor ?

is problem in eku ? in long certification path ? iis7 form restricted cert.sign.request ?

how should form cert.sign.request on side ? should bring certificate services in domain proper certificate request templates ?
should demand specific ssl vendor when buying certificate them (to make usabel rdp) ? should sign cert.serv. root @ ssl vendor simple purpose ? (i afraid going cost money afford)

thank in advance competent , useful replies .

hi,

the oids (1.3.6.1.4.1.311.10.3.3 & 2.16.840.1.113730.4.1) said in essentialssl trial indicate sgc cert.  possible 1 or more of certs in chain alphassl trial cert sgc cert well.  based on reading thread kristin referred explain problem seeing windows 7 clients.

i recommend obtain ssl certificate not sgc certificate , not have sgc certificates in chain.  example, can purchase standard non-sgc ssl certificate godaddy for $12.99/year.  godaddy certificate has 1 intermediate certificate in addition root.  $12.99 price google godaddy $12.99 ssl , click on link.

another alternative rapidssl certificate www.rapidsslonline.com.  low $10.99/year , issued directly root certificate (geotrust), in other words, no intermediate cert.  offer 30-day money guarantee.  not sgc certificate, , root not sgc certificate. 

there other providers are cheaper or free  (startssl), however, have not tested them.

if need secure multiple servers/rds roles should consider wildcard certificate (as low $99/year), or ucc/san certificate ($60/year).  if of rds servers/roles can under single domain wildcard convenient.  because can add new server names needed , still use same certificate all.  if have older rd client versions in environment ucc or wildcard may cause problems.

-tp

Windows Server  >  Remote Desktop Services (Terminal Services)