windows terminal services server ssl vs tls

Copy the exported PFX file from the server to the client machines that have RDP files.You MUST choose to include the cert’s Private Key when exporting.Export that LetsEncrypt certificate on the server from the server’s certificate store under.First - Copy the Let’s Encrypt certificate that you want to use from - and Paste it into the certificate store under.We need to digitally sign the RDP files on the client machines with an SSL certificate to get rid of the message.Even though we have a valid LetsEncrypt certificate in the server’s certificate store -, RDP clients still see a “The identity of the remote computer cannot be verified” message when trying to connect.Besides, this is the best way to see what is actually happening. I only have a couple of client stations that it is needed on, so I have not taken the time to automate the process. I’ll give you the manual steps that I take. In summary, has anyone tried to automate this use case? Any tips? Maybe it just need extra processing/packaging in a different format? The way to configure it and reloading it is outside the scope of this community site (even though if you found a killer guide/blogpost, I would be very grateful!), but I would like to know if a certificate from Let’s Encrypt is compatible with such a use case. The next step would be the setup of Remote Desktop services to use the certificate. Can you confirm that this would allow me to pass the DNS challenge, if properly configured? Many other DNS providers offer APIs to make such changes. In our case, our domain and public DNS are hosted on OVH, which as far as I can tell has an API to manage the DNS zone programmatically. The second assumption is that a DNS challenge becomes the necessary way of obtaining the certificate, since servers/workstations are not accessible directly from outside our network via public-facing DNS.

The main assumption is that I’d like to automate the whole process of renewal.

I did some googling about this, but many informations are outdated or not specific to this issue. One might argue that using self-signed certificated is valid in the context of the local network, but I don’t like the idea of collecting self-signed certificates in my keychain, plus it would also stop people from the company to dismiss security warnings about certificates. Since we’re setting up our local network with a domain, I’d like to properly secure our connections to Remote Desktop sessions.

Windows terminal services server ssl vs tls