Solved

the certificate is not from a trusted certifying authority

Posted on 2016-08-05
8
255 Views
Last Modified: 2016-08-07
Please help!  

I have a simple server that I have enabled RDP on at work.  I go home, fire up Remote Desktop, type in a public IP address, log on with my credentials, and I'm in.  

During the logon process, I get an alert like the one attached: "the certificate is not from a trusted certifying authority".  If I go through the process of installing the certificate, I get the prompt "The server name on the certificate is incorrect".  

I don't want to ignore the prompt (I have to explain the prompt to management).  Is there a way I can get rid of it without having to buy an external certificate, setup an enterprise CA, or setting Remote Desktop to not warn me about it (advanced tab > server authentication option)?  Can I safely ignore it, since I'm using an IP address that I know, and can be fairly certain it's not a man in the middle attack?  I do have NLA enabled on the remote box.  

The remote box is server 2012 and my home computer is Windows 7 with the latest version of Remote Desktop.  

Thank you all, I appreciate any help I can get.
0
Comment
Question by:npinfotech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
8 Comments
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 41745179
Self-signed certificates are never 'trusted'.  You have to purchase a certificate from a reputable vendor to get it to be "from a trusted certifying authority".  Only then will there be a certificate chain that leads back to a "trusted certifying authority".
0
 
LVL 81

Expert Comment

by:David Johnson, CD, MVP
ID: 41745369
Since you don't want to set up a proper certificate you can elect to ignore it.  If the certificate changes you will have to agree to ignore it in the future.
0
 
LVL 8

Author Comment

by:npinfotech
ID: 41745618
Thank you for the responses, I appreciate them.  

My understanding is that the point of the prompt is to ultimately help prevent man-in-the-middle attacks.  Since I am using NLA and am using an IP address to connect, is a man-in-the-middle still possible, or highly unlikely?
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 100 total points
ID: 41745705
I thought your problem was having to explain why you are getting the prompt.  If you use the current cert, each new user will get the prompt and have to accept it.  The only way around that is to buy a cert that is traceable to a "trusted certifying authority".
0
 
LVL 8

Author Comment

by:npinfotech
ID: 41745760
Thanks.  Is there a way I can visually tell if the information on the prompt is actually legitimate (spot if something is wrong)?
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 41745772
Certificate error messages normally give the details of their complaint.  A valid certificate will show in the address bar where you can click on it to get more info about it.
0
 
LVL 81

Accepted Solution

by:
David Johnson, CD, MVP earned 400 total points
ID: 41745801
With a self-signed certificate ANYONE can create a certificate using ANY name including the expected name that you are expecting. If you are worried about MITM then vpn into the domain then connect your rdp session. MITM isn't that easy to implement without physical access to the internet endpoints.
0
 
LVL 8

Author Comment

by:npinfotech
ID: 41746558
I will be opening another thread based on this
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

By default the complete memory dump option is disabled in windows . If we want to enable the complete memory dump for a diagnostic purpose, we have a solution for it. here we are using the registry method to enable this.
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question