I have a Windows 8.1 machine that I RDP into on a public IP (also secured by 2FA). I am getting a failing PCI scan because the default SSL cert created by Windows for RDP is using SHA1 hashing.
So I got an official cert (SAH256, wildcard) and imported this into the Local Computer's Personal Certificates + added the SSLCertificateSHA1Hash registry value (both per https://support.microsoft.com/en-us/kb/2001849, though this is for Windows 7). Note that I did not see how to perform the last step (setting the ACL of they key file used by RDS to include NETWORK SERVICE), since the instructions for this for Windows 7 did not work for Windows 8.
After this, I first could not connect at all. Then when I tried again, I could connect, but it was still using its auto-generated cert. In the event log, I see this:
The RD Session Host Server is configured to use a certificate but is unable to access the private key associated with this certificate. The name on this certificate is *.acme.com. The SHA1 hash of the certificate is in the event data. The default certificate will be used for RD Session Host Server authentication from now on. Please check the security settings by using the Remote Desktop Session Host Configuration tool in the Administrative Tools folder.
Perhaps all that is needed is to set the ACL for the key file, but I could use some help with that...
Or more broadly: how can I make Windows (8.1) use the official SSL cert for RDP?