When you use the Remote Desktop Connection client to connect to a remote computer that does not have a valid SSL certificate, you are presented with a box similar to this: RDP certificate error

I already know how to deal with this, to make the box not appear at every connection ("check Don't ask me again..."). I also know how to make the box reappear after "Don't ask me again" has been checked. (There are several posts to this effect here on superuser.) An option in this dialog allows you to review the server certificate.

My question is when using Remote Desktop Connection client to connect to a server that has a valid certificate issued by a trusted certification authority, how do I view the certificate? (Assume that I do not have access to the certificate store on the remote server.)

In the connection bar of Remote Desktop Connection version 6.3.9600 there appears a padlock, similar to what you might see in a web browser. However, clicking on the padlock only reveals MSTSC Padlock dialog

Again, how do I view the certificate used by Remote Desktop Connection when the certificate is valid?

EDIT: In my initial testing, I was using a client PC (non-domain) to connect to the server on the same subnet. The security (padlock) icon in MSTSC indicated authentication by kerberos. A subsequent test from a PC on a remote network indicated authentication by server certificate, and gave me the option to view the certificate.

So now I am wondering why the local connection authenticated by kerberos and the remote connection by certificate?

  • P.S. -- Credit for the error message image goes to Ian Boyd ( superuser.com/users/8169/ian-boyd ) – Jonathan J Feb 13 '15 at 20:02
  • Is this a corporate network? e.g. a managed domain – dkanejs Feb 13 '15 at 20:04
  • 1
    The server in question is in an Active Directory domain. The client PC is not joined to the domain, and has not imported the certificate. The server has supposedly been configured with an SSL certificate from a third-party certification authority, not the Windows CA in the domain. I need to verify which certificate is actually being used. – Jonathan J Feb 13 '15 at 20:08
  • The handshake may be recorded, you could check eventvwr on the client to see what certificate was used. – dkanejs Feb 13 '15 at 20:11
  • I found a workaround for what I needed to do... connect to the server by IP address rather than name. This forces the error message to appear, where I can click to view the certificate. However, it really doesn't answer the question of how to view the certificate when it's valid for the server named in the connection. – Jonathan J Feb 13 '15 at 20:30

Kerberos doesn't use certificates. If the connection was secured with Kerberos then there is no certificate to view on this connection.

| improve this answer | |
  • Oddly enough, if there is a valid certificate on the server the client tells you that the connection was secured with both kerberos and a certificate, and allows you to view the certificate. It seems that it is only if it doesn't like the certificate that it decides to just use Kerberos. – Harry Johnston Sep 16 '19 at 2:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.