Remote Desktop Gateway connection intermittent with certificate error
When attempting to remote desktop into an RDS gateway server, we are receiving the following error:
"Your computer can't connect to the remote computer because the Remote Desktop Gateway server's certificate has expired or has been revoked. Contact your network administrator for assistance."
The server is Windows Server 2008 R2, and we are positive the SSL certificate is valid. RDWeb is working fine and can be used to remote desktop other computers on the network without issue.
We have already tried reinstalling the RDS role and had the certificate reissued. We have been seeing this issue connecting from Windows 7, Server 2008, and from the Microsoft Remote Desktop app from iTunes. Oddly enough, if you keep trying, the connection will eventually succeed after a random number of times. On some systems, the connection succeeds nearly 100% of the time.
"Your computer can't connect to the remote computer because the Remote Desktop Gateway server's certificate has expired or has been revoked. Contact your network administrator for assistance."
The server is Windows Server 2008 R2, and we are positive the SSL certificate is valid. RDWeb is working fine and can be used to remote desktop other computers on the network without issue.
We have already tried reinstalling the RDS role and had the certificate reissued. We have been seeing this issue connecting from Windows 7, Server 2008, and from the Microsoft Remote Desktop app from iTunes. Oddly enough, if you keep trying, the connection will eventually succeed after a random number of times. On some systems, the connection succeeds nearly 100% of the time.
Last Comment
ASKER
We have already imported a valid SSL certificate into the RDS gateway MMC. This certificate was recently purchased and doesn't expire for several years.
What happens when you open the Certificates MMC for the Local Computer/Personal store and double click on the new SSL certificate? Does it show up as valid?
ASKER
The certificate does show up as valid.
I'm assuming you deleted the old expired certificate from the store as well once it was replaced? Sorry, have to cross off the standard stuff first.
Do you see any warnings/errors in the logs when you attempt to connect remotely via RD Gateway?
Do you see any warnings/errors in the logs when you attempt to connect remotely via RD Gateway?
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Thanks everyone for your responses. Abhishek, I downloaded the certificate revocation list from the URL provided in the details for the certificate. However, I was unable to find the serial number for our certificate in the revocation list.
One complication to this is that we have actually just reissued our RDS gateway certificates to use SHA-256 after they were previously all SHA-1. The certs were working fine until recently, but we have deleted the old certs from the server (issue persists).
One complication to this is that we have actually just reissued our RDS gateway certificates to use SHA-256 after they were previously all SHA-1. The certs were working fine until recently, but we have deleted the old certs from the server (issue persists).
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
The server was not improperly configured. Our clients likely had issues with a larger bit length in the SSL certificate.
Windows Server 2008
Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.
86K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
If it's showing the old certificate that has expired, click Select an existing certificate from the RD Gateway SERVER Certificates (Local Computer)/Personal store > then click on the Import Certificate button > select your recently renewed certificate > OK > RD Gateway Manager show now show the correct certificate. Test the RD Gateway again.
If you still don't see the new SSL certificate, restart the Remote Desktop Gateway service (NB: this may kick out everyone currently logged in via RD Gateway).
Let me know how you go.