You can set this host machine to use and present your (existing) externally-verified SSL certificate thus (instructions probably also work for Windows 8 & 8.1, may or may not work for Windows 7) (parts of this based on a Microsoft KB 2001849):
First, you need to have a genuine verified ssl certificate, whether one you purchased or a free one from e.g. LetsEncrypt.
If you have this certificate in pkcs12 format file (e.g. pfx extension) you can view SHA1 fingerprint using Linux or Cygwin thus (you will need it below):
openssl pkcs12 -in mysite.pfx -nodes|openssl x509 -noout -fingerprint
Alternatively if you have the individual certificate files in your Linux server at /etc/ssl (/etc/ssl/certs/mysite.crt, /etc/ssl/mysite.ca-bundle and /etc/ssl/private/mysite.key) you can create pfx file and obtain SHA1 fingerprint thus:
Create pfx file for your certificate, if you don’t already have one (here: mysite.pfx) – set a good password when requested:
sudo openssl pkcs12 -export -out mysite.pfx -inkey /etc/ssl/private/mysite.pem -in /etc/ssl/certs/mysite.crt -certfile /etc/ssl/mysite.ca-bundle
Move or copy this pfx file as required so that it is accessible by your Windows host machine.
View SHA1 fingerprint of the key (you will need this below):
openssl x509 -in /etc/ssl/certs/mysite.crt -noout -fingerprint
Import pkcs12 format (e.g. pfx) file into Windows host machine’s personal certificates store:
- Start > Run > mmc
- File > Add Remove Snap-in > Certficates > Add > Computer Account > Local Computer > OK
- In the left-hand window right-click on Certificates (Local Computer)Personal, choose All Tasks/Import…
- Locate the pfx file and import it, I suggest that for security reasons you don’t make it exportable.
- Expanding your Personal/Certificates you should now see 3 certificates, one of which is your site certificate (e.g. mysite.com). Right-click on this site certificate and right-click, choose All Tasks / Manage Private Keys…
- Add user ‘NETWORK SERVICE’ with Read permission only (not Full Control), then Apply
- Close mmc
Use regedit to add a new Binary Value called SSLCertificateSHA1Hash at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp. The value it needs is the SHA1 fingerprint of the certificate obtained above: right-click on the new value, choose Modify and then type in the hex codes sequentially (without colons or spaces or commas, letters are not case-sensitive) – there are 20 hex pairs in all (40 characters).
You may need to reboot the host machine, or restart Remote Desktop Services (from Services.msc) before it will work.
Now, after making a remote desktop connection to this host using the correct site name (e.g. mysite.com) you should see a locked padlock on the left-hand side of the top connection bar: clicking on this shows that the identity of the remote computer was verified. A port that is open from the internet through to this host should now pass PCI-DSS 3.1 hostname testing.