RDP Certificate Error

RDP Certificate Error KB ID 0001946

Problem: RDP Certificate Error

In fairness, with most certificate errors the popups will give you a pretty descriptive error so you can work out what the problem is. But experience has taught me people are terrified of certificates. Here’s a run through of some common errors and how to navigate around them.

Solutions: RDP Certificate Error

If you are one of the nervous certificate types please go and read my Golden Rules of Certificates. Bookmark it and every time you have to roll your sleeves up give it the once over

RDP Certificate Error: The Server name on the certificate is incorrect

The Identity of the remote computer cannot be verified. Do you want to connect anyway?
Certificate Errors
The Server name on the certificate is incorrect

Probably the simplest one of all, if you look at the text above, you attempted to connect via RDP to the servers IP ADDRESS, BUT the NAME (this can be the common name CN or a Subject Alternative Name SAN on the certificate). is the name of the server, (in this case the FQDN of the server, probably constructed from its Active Directory Object – if the certificate was issued from a template).

Correct Fix: Connect to the FQDN instead in this case sql-01.petescluster.net,

Before you throw your arms up in disgust: I get it, if your connecting over the internet, DNS might not resolve, you may HAVE TO use an IP address either a public one or a private one if you connecting over a VPN. If its just you, learn to use host files (like its 1985!)

Can’t I just embed the IP address as a Subject Alternative Name? Well yes, but you’d have to do it manually for each RDP target and supply that information when you requested the certificate from certificate services, that fixes the problem but DOES NOT SCALE AT ALL

RDP Certificate Error: The certificate is not from a trusted certifying authority

The identity of the remote computer cannot be verified. Do you want to connect anyway?
Certificate Errors
The certificate is not from a trusted certifying authority.

Well, you read my link {above} you understand that any certificate is useless if you DON’T trust the certification Authority that issued it. That’s what this is telling you, one of two things has happened.

1. The server you are connecting to just created its own ‘self signed’ certificate and its using that, (which you don’t trust)

2. The server you are connecting to may have a valid certificate, but you simply don’t trust the CA that issued it.

To discern which is you problem simply click View certificate.

If it looks like this it’s a self signed certificate (hint:Issued by is the same as Issued to)

If yours looks like this then the certificate has been issued by a certification authority – that you probably don’t trust.

But I’m RDP connecting to my CA Server! Well OK, but your CA name and your server-name DON’T have to be the same, in fact its good practice to not have them the same, this would only ever happen if you’re one of those people who install certificate services, and then just click next thirty two times, (and your done). In the unlikely event your right, check your issued certificates against the CA server name.

OK, mines self signed: Then either put up with the error of deploy a certificate services deployment (with a CRL or you will get more errors!) I’ve covered planning a PKI infrastructure before, simply follow this guide.

Microsoft PKI Planning and Deploying Certificate Services

Mine’s been issued by my own CA Server: Then you only need to install the Root-CA certificate on the server you are trying to connect FROM*.

*Note: In some cases you may need to install a root CA cert and an intermediate CA cert, you will be able to tell this by looking at the ‘Certification Path” section of the certificate it will show you how many certification authorities are in the chain.

Getting the root CA certificate should be relatively easy (I always put a copy in the CRL folder so I can get hold of it quickly via http or by browsing to the folder.

On the Certificate Services Management Console > Properties > View Certificate > Details > Copy to File.

Next > Select Base 64 encoded > Next > Chose a location to save the file > Next > Finish.

Then copy the file to your client machine and simply double click it, and select ‘Install Certificate’.

Then follow the wizard. Select Local Machine > Save the certificate in ‘Trusted Root Certification Authorities‘ > Finish.

RDP Certificate Error: A revocation check could not be performed for the certificate

The identity of the remote computer cannot be verified. Do you want to connect anyway?
Certificate errors
A revocation check could not be performed for the certificate

This is because your Certificate Services deployment does not have a correctly configured CRL, or the machine that you are connecting from cannot see your CRL.

Setting up a CRL is pretty straightforward, I’ve covered that in detail here;

Windows Certificate Services – Setup a CRL

Setting RDP Certificates up Correctly (In a Domain)

To be fair, I’ve already covered this in the past, you can see that article here;

Windows Server – Secure RDP Access with Certificates