We value your feedback.
Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!
Course Of The Month
6 days, 9 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Certificates and RDS on Windows Srvr 2012 R@
Posted on 2014-04-01
Setup:
RDCB, RDWA, RDGW, License Server installed on one 2012 Server
RDSH installed on two separate 2012 servers.
My internal domain is a trusted.local
Our external domain is companyname.com
I need both internal and external users to be able to access internal resources.
I have been trying to find out what type of certificates I need, how many and what domain names should be used for the certificates. Also, once I have the certs where do they get installed?
Any help would be appreciated.
RDCB, RDWA, RDGW, License Server installed on one 2012 Server
RDSH installed on two separate 2012 servers.
My internal domain is a trusted.local
Our external domain is companyname.com
I need both internal and external users to be able to access internal resources.
I have been trying to find out what type of certificates I need, how many and what domain names should be used for the certificates. Also, once I have the certs where do they get installed?
Any help would be appreciated.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
7-
5
12 Comments
Active today
The problem here is that you won't be able to get a certificate for the .local aspect of this due to current SSL policies (ability to prove ownership of domain).
If all of these are domain computers and you have a CA I would use a CA issued cert for the .local since all your domain computers should trust it.
Normally you could have gotten a SAN / UC cert for this.
If all of these are domain computers and you have a CA I would use a CA issued cert for the .local since all your domain computers should trust it.
Normally you could have gotten a SAN / UC cert for this.
What about computers outside our local network who need to access network resources via RDS....don't I need a trusted certificate?
Active today
Just reconfigure both to use .com and update internal dns.
Or distribute your ca root to clients connecting
Info on .local.
http://www.digicert.com/internal-names.htm
Or distribute your ca root to clients connecting
Info on .local.
http://www.digicert.com/internal-names.htm
How to get certificates for a .com domain to also work inside a network that is running .local domain name.
Active today
Update your internal instance to use the same .com certificate and add an A or CName record to point to the same IP address that trusted.local now resolves to.
Certificate resolve to NAMES and DNS names resolve to IP address resources.
You cannot work around a certificate responding the right name but you can get DNS to point to any resource if you have control of DNS.
Certificate resolve to NAMES and DNS names resolve to IP address resources.
You cannot work around a certificate responding the right name but you can get DNS to point to any resource if you have control of DNS.
Active today
Really sorry the solution was actually very simple:
1) DNS resolves to the name you have configured for RDS server
(since you cannot get a valid .local certificate- you can simply use you.com certificate and update your dns to use the .com name on the certificate and point it to the IP of the RDS server)
2) Create an internal .local certificate and simply ask your users to click past it not being trusted when they attempt to login.
Either one of the above would work perfectly for you, I can provide instructions as detailed as needed to get there but it is not excessively difficult.
1) DNS resolves to the name you have configured for RDS server
(since you cannot get a valid .local certificate- you can simply use you.com certificate and update your dns to use the .com name on the certificate and point it to the IP of the RDS server)
2) Create an internal .local certificate and simply ask your users to click past it not being trusted when they attempt to login.
Either one of the above would work perfectly for you, I can provide instructions as detailed as needed to get there but it is not excessively difficult.
Active today
Ok if you do not want to do a CA you can just do a self-signed cert- however this would lead you to getting a prompt indicating the certificate is not trusted.
Here is a link on configuring SSL for RDS:
http://technet.microsoft.com/en-us/library/dd320345%28v=ws.10%29.aspx
I would just create an additional DNS record for the internal users:
e.g
external:
RDS.companyname.com - pointing to the external IP
Internal:
RDS.trusted.local - pointing to the internal IP
RDS.companyname.com - pointing to the internal IP
Once the RDS server is configured to answer on RDS.companyname.com external folks will get the external IP but the server configured for eXternal users
Internal Users will get the one configured for internal users.
Or you can simply create an A record pointing to the internal server that does not match and request a SAN name for the cert that matches that name e.g:
One cert with two SANS
Subject for external:
RDS.RDS.companyname.com
Subject for Internal
InternalRDS.companyname.co
All you would do is configure the external server to match the DNS name and the internal to match the internal DNS name.
Here is a link on configuring SSL for RDS:
http://technet.microsoft.com/en-us/library/dd320345%28v=ws.10%29.aspx
I would just create an additional DNS record for the internal users:
e.g
external:
RDS.companyname.com - pointing to the external IP
Internal:
RDS.trusted.local - pointing to the internal IP
RDS.companyname.com - pointing to the internal IP
Once the RDS server is configured to answer on RDS.companyname.com external folks will get the external IP but the server configured for eXternal users
Internal Users will get the one configured for internal users.
Or you can simply create an A record pointing to the internal server that does not match and request a SAN name for the cert that matches that name e.g:
One cert with two SANS
Subject for external:
RDS.RDS.companyname.com
Subject for Internal
InternalRDS.companyname.co
All you would do is configure the external server to match the DNS name and the internal to match the internal DNS name.
Featured Post
The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.
One of a set of tools we're offering as a way of saying thank you for being a part of the community.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
So you need a certificate so you can offer SSL encryption. But which one should you get? There are so many choices out there!
Here is a generic overview of the main types of SSL certificates sold by the majority of commercial Certification Auth…
Remote Desktop Shadowing often has a lot of benefits. When helping end users determine problems, it is much easier to see what is going on, what is being slecected and what is being clicked on. While the industry has many products to help with this,…
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video.
We have explained the difference between…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Suggested Courses
Course of the Month6 days, 9 hours left to enroll
Earn Certification
CCENT-Cisco Certified Entry Networking Technician 100-101
$99.00$89.10
726 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.