Here is the issue I can't resolve. Remote RDP server presents a self-signed certificate, and I want to block any connection on client-side when RDP server is using non compliant certificate.

I found a configuration that should enforce server authentication, but it is only blocking when server name in RDP client does not match server certificate CN (for exemple, if i try to connect using IP instead of host).

I can't find any local configuration (GPO, local strategy...) to block RDP connection when server is using a self-signed certificate.

(I am not looking for configuring a compliant certificate on server side, because anyway, my client is configured to accept any certificate that has the server name is the certifcate CN field).

  • The only reason a self-signed certificate would be trusted would be because the root certificate that signed it was already trusted. – Ramhound Jan 2 '18 at 13:05
  • Is the machine part of a domain? – Twisty Impersonator Jan 2 '18 at 13:18
  • Is your question, "[How to] block RDP connection when server is using a self-signed certificate?", or, "Why is my server's self-signed certificate trusted by my client?" It seems like your end goal is to answer the first, yet your question title is the second. – Twisty Impersonator Jan 2 '18 at 16:02
  • @Ramhound No it is a self-signed not trusted by my client desktop (not signed by any custom or official root) – crypto-learner Jan 2 '18 at 16:29
  • @TwistyImpersonator My question is the first : "How to block..." but I also want to understand why my RDP client does validate a self-signed certificate, it should not be the case by default, and when I enabled "Server authentication" in RDP local strategy, same result... It seems that my RDP client only validates that server host = certificate CN, but does validate the certification path – crypto-learner Jan 2 '18 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.