1

I have a Windows 8.1 machine that I RDP into on a public IP (also secured by 2FA). I am getting a failing PCI scan because the default SSL cert created by Windows for RDP is using SHA1 hashing.

So I got an official cert (SAH256, wildcard) and imported this into the Local Computer's Personal Certificates + added the SSLCertificateSHA1Hash registry value (both per https://support.microsoft.com/en-us/kb/2001849, though this is for Windows 7). Note that I did not see how to perform the last step (setting the ACL of they key file used by RDS to include NETWORK SERVICE), since the instructions for this for Windows 7 did not work for Windows 8.

After this, I first could not connect at all. Then when I tried again, I could connect, but it was still using its auto-generated cert. In the event log, I see this:

The RD Session Host Server is configured to use a certificate but is unable     
to access the private key associated with this certificate. The name on this 
certificate is *.acme.com. The SHA1 hash of the certificate is in the event 
data. The default certificate will be used for RD Session Host Server 
authentication from now on. Please check the security settings by using the 
Remote Desktop Session Host Configuration tool in the Administrative Tools 
folder.

Perhaps all that is needed is to set the ACL for the key file, but I could use some help with that...

Or more broadly: how can I make Windows (8.1) use the official SSL cert for RDP?

1
  • What's with the down-vote? Care to add a comment to explain??
    – Zek
    Feb 9, 2016 at 15:29

2 Answers 2

0

The RD Session Host Server is configured to use a certificate but is unable to access the private key associated with this certificate.

  • Open MMC

  • File Add/Remove Snapin

  • Add Certificates

  • For the Computer account

  • on the Local computer

  • Navigate to your cert

  • Right-click, All Tasks, Manage Private Keys

  • Grant the RD service user Read access to the Private Key

Then set RD to use your certificate again, and try it.

1
  • that is what I meant by, "Note that I did not see how to perform the last step (setting the ACL of they key..." - there is no "Manage Private Keys" option under All Tasks (Windows 8.1).
    – Zek
    Feb 9, 2016 at 15:31
0

I got this working.

The problem was that I only had imported the .cer file (which does not contain the private key, thus no option to "manage private keys"). After I generated a .pfx file instead and imported that certificate the option to manage keys showed up and the instructions here worked fine: https://support.microsoft.com/en-us/kb/2001849.

You must log in to answer this question.