I am in the process of configuring a remote desktop environment in 2012 R2. I am allowing internal and external access through RDWeb. My configuration is as follows:
RDWeb/Gateway on server NAT'd through firewall
Server DNS name (internal) rdweb.company.com
192.168.1.1 (Internal)/ 345.678.901.1 (external IP, secured with SSH. Gateway.company.com/rdweb)
RD Connection Broker
Server DNS Name (internal) rdbroker.company.com (assigned by changing the server name using a powershell script)
(192.168.1.2)
RD Session Host
Server DNS name (internal) rdsh.internal.company.com
(192.168.1.3)
Each server has a wildcard certificate installed on it.
Have DNS multi-zoned internal: company.com, internal.company.com
I have published apps on the RDWeb site. When launching an app, my issue arises when the connection broker hands off to the session host server - only when connecting from an external (off domain) machine - I get a "name mismatch" error certificate
pop-up saying:
The remote computer could not be authenticated due to problems with its security certificate
Name mismatch
Requested remote computer: rdsh.internal.company.com
name in the certificate for the remote computer: *.company.com (wildcard cert)
Certificate errors
The server name on the certificate is incorrect.
Now, from what I can see, this only occurs when connecting from a remote computer - not from a computer connected to the domain. How, if I can, do I stop this from happening? I ultimately would want this session host server to use the wildcard certificate,
but why does the session broker seem to use the internal FQDN instead of the name I specify through the wildcard?
Also, in a sewnse, I guess I am trying to figure out is if there is a way to either fix this with a self-signed cert from the machine (tried that, it just says that this is an untrusted cert from an untrusted provider) or manipulate the RDS implementation/Session
Host server in a way which mimics the name I want to pass through. My wildcard certs work on the Web/gateway server and on the connection broker - this is configured automatically through the RDS configuration when building out the servers. There is nothing
in the configuration, however, which talks about securing the session host server. Has anyone run into this, and how have you fixed it? Internal on the domain, Kerberos fixes it. When external though, it does not use Kerberos. How does this get fixed for external
access where the cert error will not come up? I've read that having the 8.0 RDP client installed on a client machine will fix it, but I tried this, and I still get certificate errors when the connection broker hands off the connection to the session host server.
Any help is appreciated!