13

When you use the Remote Desktop Connection client to connect to a remote computer that does not have a valid SSL certificate, you are presented with a box similar to this: RDP certificate error

I already know how to deal with this, to make the box not appear at every connection ("check Don't ask me again..."). I also know how to make the box reappear after "Don't ask me again" has been checked. (There are several posts to this effect here on superuser.) An option in this dialog allows you to review the server certificate.

My question is when using Remote Desktop Connection client to connect to a server that has a valid certificate issued by a trusted certification authority, how do I view the certificate? (Assume that I do not have access to the certificate store on the remote server.)

In the connection bar of Remote Desktop Connection version 6.3.9600 there appears a padlock, similar to what you might see in a web browser. However, clicking on the padlock only reveals MSTSC Padlock dialog

Again, how do I view the certificate used by Remote Desktop Connection when the certificate is valid?

EDIT: In my initial testing, I was using a client PC (non-domain) to connect to the server on the same subnet. The security (padlock) icon in MSTSC indicated authentication by kerberos. A subsequent test from a PC on a remote network indicated authentication by server certificate, and gave me the option to view the certificate.

So now I am wondering why the local connection authenticated by kerberos and the remote connection by certificate?

13
  • P.S. -- Credit for the error message image goes to Ian Boyd ( superuser.com/users/8169/ian-boyd )
    – Jonathan J
    Feb 13, 2015 at 20:02
  • Is this a corporate network? e.g. a managed domain Feb 13, 2015 at 20:04
  • 1
    The server in question is in an Active Directory domain. The client PC is not joined to the domain, and has not imported the certificate. The server has supposedly been configured with an SSL certificate from a third-party certification authority, not the Windows CA in the domain. I need to verify which certificate is actually being used.
    – Jonathan J
    Feb 13, 2015 at 20:08
  • The handshake may be recorded, you could check eventvwr on the client to see what certificate was used. Feb 13, 2015 at 20:11
  • 1
    I found a workaround for what I needed to do... connect to the server by IP address rather than name. This forces the error message to appear, where I can click to view the certificate. However, it really doesn't answer the question of how to view the certificate when it's valid for the server named in the connection.
    – Jonathan J
    Feb 13, 2015 at 20:30

2 Answers 2

3

Remote Desktop's RDP protocol uses port 3389 and SSL. If you have openssl (or are willing to install it, the swiss army knife for SSL), then you can use this command to capture an RDP server (Terminal Server) certificate:

openssl s_client -showcerts -connect remoteserver:3389 < nul: |
    openssl x509 -outform PEM > remoteserver.cer

That's one line and works on the old command prompt. For PowerShell use:

$null | 
    openssl s_client -showcerts -connect remoteserver:3389 |
    openssl x509 -outform PEM > remoteserver.cer

This is what's happening

  • 'openssl s_client' starts an SSL client.
  • nul: or $null is used because we don't have data to send to the server
  • '-showcerts' outputs the server certificate (sent by the server)
  • '-connect' specifies the host and port

The first invocation of openssl outputs details of the requested ssh connection including the remote server certificate. This output is passed into a second instance of openssl to pull out just the certificate.

  • 'openssl x509' starts certificate processing
  • '-outform PEM' sets output format to base64 encoding with header and footer.
  • '> remoteserver.cer' captures the output to a file.
1

Kerberos doesn't use certificates. If the connection was secured with Kerberos then there is no certificate to view on this connection.

1
  • 1
    Oddly enough, if there is a valid certificate on the server the client tells you that the connection was secured with both kerberos and a certificate, and allows you to view the certificate. It seems that it is only if it doesn't like the certificate that it decides to just use Kerberos. Sep 16, 2019 at 2:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .