Tag: Remote Desktop

Server 2012 R2 : Change Remote Desktop SSL Certificate in 3 Easy Steps

On By GarrettHamptonIn Technology7 Comments

Working on a Server 2012 Standard R2 today that had an initial SSL self signed certificate.  I needed to replace that certificate, so IIS and Remote Desktop would stop warning users about the security issue.  In Server 2008, you could select which certificate you wanted Remote Desktop connections to use.  In Server 2012 that GUI has been removed.  It took me a little while to get everything down for Server 2012, but these are the steps I took.  Hope this helps out someone else later on!

  1. Get the Thumbprint of the SSL certificate you want Remote Desktop to use
    1. Windows + R
    2. Type in mmc and hit enter
    3. Control + M (or File -> Add/Remove Snap In)
    4. Click on “Certificates” in the “Available snap-ins:” section
    5. Click the “Add >” button
    6. Select “Computer account”
    7. Click Next
    8. Select “Local Computer:”
    9. Click the “Finish” button
    10. Click “OK” button
    11. Open the “Certificates (Local Computer)” then, “Personal” and then “Certificates” sub folder.
    12. Double click the certificate you want Remote Desktop to use
    13. Click the “Details” tab
    14. Select “All” under “Show:” and scroll down to the “Thumbprint” field and select the “Thumprint” field.
    15. Copy the text of the hash.
    16. Remove all spaces from your copied hash
  2. Open “Power Shell” as an Administrator
  3. Run these power-shell commands (replace YOUR HASH HERE with your thumbprint you copied from step 1 above).  You can run each line one after the other.
    1. $TSGeneralSetting = Get-WmiObject -class “Win32_TSGeneralSetting” -Namespace root\cimv2\terminalservices -Filter “TerminalName=’RDP-tcp'”
    2. $Hash = “YOUR HASH HERE”
    3. $TSGeneralSetting.SSLCertificateSHA1Hash = $Hash
    4. $TSGeneralSetting.put()

PowerShell should prompt you that everything went over successfully.  Connect to the server again with Remote Desktop or RemoteApp, and it should be using the new SSL configuration!