[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

TS gateway

Posted on 2010-09-21
19
Medium Priority
?
973 Views
Last Modified: 2012-05-10
hi,

My environment is using a TS gateway server as a proxy for clients to RDP to APP servers. My questions are:
1) Clients using RDP with TS gateway will still get a prompt identifying the APP server certificate before connecting, is this correct?
2) Can i use the TS gateway cert and import the cert to all APP servers so that i won't get the prompt?
3) How to generate a cert for use in all servers?

Thanks
0
Comment
Question by:NeedHelp2010
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 6
19 Comments
 
LVL 8

Expert Comment

by:psychogr
ID: 33728375
1. Correct
2. Yes it is located under C:\users\Public\Public Downloads or \\servername\public\public downloads
3. It should be already generated from fist setup. If its not there or you changed domain since your installation then use Internet Address Management Wizard (IAMW) to generate a new one
0
 

Author Comment

by:NeedHelp2010
ID: 33731393
to further add on, we do not have a CA or PKI in our environment.

When i use the TS gateway cert and import to my APP servers, when i RDP in through a Client, there is a prompt saying my Cert name mismatch as the issuer name is: 123.abc.com but the cert name is 123wts.abc.com so how can i create a cert that can be used by all APP servers.

My question 2 is how do i import a cert to the APP server so that when i RDP with a TS gateway proxy, i won't get a certificate prompt.

Thanks
0
 
LVL 8

Expert Comment

by:psychogr
ID: 33731985
if you get a 'name missmatch' error then you should recreate your certificate via Internet Address Management Wizard (IAMW)

You dont need a CA or PKI all you need is a self signed certificate..
for more information:

http://blogs.technet.com/b/sbs/archive/2008/09/30/how-do-i-distribute-the-sbs-2008-self-signed-ssl-certificate-to-my-users.aspx

http://blogs.technet.com/b/sbs/archive/2007/04/10/installing-a-self-signed-certificate-as-a-trusted-root-ca-in-windows-vista.aspx
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:NeedHelp2010
ID: 33767497
sorry maybe my question is not clear enough.

 my question are:

1) When i login from a XP SP2 RDP 6.0 client with a  W2008 TS  gateway server as a proxy to a W2008 APP server e.g abc.123.com. I will get a prompt saying the cert is not from a trusted CA authority. Is this a correct setup?

2) Is there any way for me to create a single SSL cert for all my clients and servers to use for SSL RDP authentication? I am trying to use a wildcard cert but it always prompting name mismatch as the cert name is *.123.com but issuer is abc.123.com.

My environment is not using a CA to publish the Cert template for authentication.

 
0
 
LVL 8

Expert Comment

by:psychogr
ID: 33767535
1. yes it is a correct setup. If you install the certificate using the installer from C:\users\Public\Public then it will stop prompting you for a certificate.
2.  You cannot create a certificate using wildcard. It must be unique for each subdomain/domain.
You must create a certificate and distribute it as i described on my last post.

You dont need ca authority just a self signed cert..
0
 

Author Comment

by:NeedHelp2010
ID: 33767748
hi psychogr,

i am not using SBS edition, i am using W2008 R2 enterprise edition. I cannot see anything in C:\users\Public\Public and how to use IAMW?

Thanks
0
 
LVL 8

Expert Comment

by:psychogr
ID: 33767935
oooops sory for that mate.. for some reason i though you had sbs ed..
There's no IAMW on windows 2k8 r2 editions.

Follow steps described on the above link to create a self-signed certificate
http://technet.microsoft.com/en-us/library/cc730805.aspx

0
 

Author Comment

by:NeedHelp2010
ID: 33768038
hi psychogr,

haha its ok.

I have already created aa cert for use with my TS gateway server which is like ts.123.com,  i have import the cert to my RDP client and APP server, but when i do a RDP connection from the client to my APP server through a TS gateway, i will get a cert error prompt saying name mismatch as the remote computer name is abc.123.com but cert name is ts.123.com.

Is there any way for me to use the TS cert as a common cert for RDP connection between all my Clients and APP servers without a CA setup in my domain?

Thanks
0
 
LVL 8

Expert Comment

by:psychogr
ID: 33768106
The FQDN must match the DNS name that the client uses to connect to the RD Gateway server
Thats why you get a name mismatch error. Follow the steps described on the link from my previous post to create a new cert. Distribute it an you are set to go
0
 

Author Comment

by:NeedHelp2010
ID: 33768189
haha psychogr,

i think my question is not clear again.

If client connect to my TS gateway server using FQDN, there is no problem but when i RDP frm my client to my APP servers and use the TS gateway cert, i get a name mismatch as my APP server name is not the same as the FQDN name on the cert.

So i am asking if there is any way other than having a CA server in the domain to use a single cert for RDP connection?

I have tested with W2008 RDC6.1 and there is no such problems but if using RDC 6.0 from XP SP2, i will get a certificate warning prompt.

0
 
LVL 8

Expert Comment

by:psychogr
ID: 33768259
ok, now i see ;)
you could create an entry in hosts file for abc.123.com pointing to the local ip of your server.
or if you have local dns server put an entry there..

hope i get it now :PP
0
 

Author Comment

by:NeedHelp2010
ID: 33768351
i dont think dns is the problem as the cert name and the server FQDN trying to RDP in is not the same so will get a certificate error pop-up.

0
 

Author Comment

by:NeedHelp2010
ID: 33775593
i think i got the answer.

I used RDC 6.1 and the cert prompt was gone..:) so if client is XP SP2, may need to upgrade to SP3 and use RDC 6.1
0
 

Author Comment

by:NeedHelp2010
ID: 33804710
the solution also cannot really work, got 1 client can RDP in without cert prompt but another XP SP3 machine will get the cert prompt....so strange..

anyone able to help??

Thanks
0
 

Author Comment

by:NeedHelp2010
ID: 33822867
anyone can help please?????
0
 
LVL 40

Accepted Solution

by:
noci earned 1000 total points
ID: 33838743
in stead of the real server name use a * in the certificate. Then you can use the certificate on all servers in the same domain.
(*.123.com in the certificate, and use it on ts, app, abc etc.)

Then you only need to accept one certificate as they all use the same.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OfficeMate Freezes on login or does not load after login credentials are input.
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question