Manual application for a Remote Desktop (RDP) certificate

There are cases in which you cannot or do not want to obtain Remote Desktop certificates from a certificate authority in your own Active Directory forest, for example, if the system in question is not a domain member.

In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).

Preliminary work

Before applying for Remote Desktop certificates, the following requirements should be met:

Active Directory subscribers must trust the certificate authority hierarchy. If the Remote Desktop certificates are issued by a third-party certificate authority, the root certificate authority certificate must be made known to all participants. This can be done, for example, via group policy, which is described in the article "Distribute Trusted Root Certification Authorities via Group Policy" is described in more detail.
In order to check the revocation status of the certificates, it must be ensured that they can be resolved (Domain Name System) as well as downloaded (routing, proxy, firewall rules) by all participants.

Inventory for the manual creation of a certificate request

First, the content of the certificate request must be determined. One of the standard certificate templates for domain controllers can serve as a reference point for this. In the following example, we will use the template described in the article "Configuring a Certificate Template for Remote Desktop (RDP) Certificates"certificate template for Remote Desktop certificates.

In the "Request Handling" tab you can see that the movement of the certificate template is set to "Signature and Encryption", which means that the Key Usage extension of the certificate will contain "Key Encipherment" and "Digital Signature", i.e. the hexadecimal value A0. This must already be taken into account during key creation on the requesting computer.

In the "Cryptography" tab, the key algorithm, the key length and the Cryptographic Service Provider (CSP) are relevant for us. The Remote Desktop template still uses "legacy" providers, i.e. CSPs that only support RSA. The key length is set to 2048 bits and the "Microsoft RSA SChannel Cryptographic Provider" is used.

In the "Subject Name" tab we see that the Subject is empty and a Subject Alternative Name is selected in the form of a DNS name.

In the Extensions tab we see that the following values are set as Enhanced Key Usage (Application Policies):

Remote Desktop Authentication (Object Identifier: 1.3.6.1.4.1.311.54.1.2)

Create Certificate Template for Manual Remote Desktop Certificate Enrollment

If the certificate request is to be answered by an Active Directory integrated certification authority, a corresponding certificate template must be defined for this authority. The procedure for this is described in the article "Configuring a Certificate Template for Remote Desktop (RDP) Certificatesis described in the "Subject Name" tab. For manual requests, however, it must be configured differently in the "Subject Name" tab that the requester can specify the identity with the certificate request.

However, since this can pose a security problem, the certificate requirements should be approved by a certificate manager, which can be achieved by enabling the "CA certificate manager approval" option in the "Issuance Requirements" tab.

Since a user account instead of a computer account will make the certificate request in the case of a manual certificate request, the corresponding user or a security group of which he is a member must be granted the "Enroll" right.

Create information file for manual certificate request

From all this information, an information file (.inf) can now be created for the certificate request. Below is an example that should generate a certificate request analogous to the Kerberos Authentication certificate template:

The information file must be saved with UTF-8 encoding. If the encoding is different, the certificate request creation will fail (see article "Creation of a manual certificate request fails with error message "Expected INF file section name 0xe0000000".„).

[Version]
Signature="$Windows NT$"

[Strings]
; Adapt the following variable to the environment
SERVER_FQDN = "CA01.intra.adcslabor.de"

; Do not edit the following strings
szOID_SUBJECT_ALT_NAME2 = "2.5.29.17" ; Do not edit the following strings.
szOID_ENHANCED_KEY_USAGE = "2.5.29.37"
szOID_KP_RDC_AUTH = "1.3.6.1.4.1.311.54.1.2"

 [NewRequest]
; According to RFC2818 the subject should not be used anymore and may be empty (Subject =)
Subject = "CN="
; The private key is not exportable
Exportable = FALSE
; The key pair is created in the local machine memory
MachineKeySet = True
; Recommended key lengths: 2048, 3072, 4096
; 2048 bits should only be used until 2021
Before increasing the key length the compatibility should be ensured
KeyLength = 3072
; AT_KEYEXCHANGE
KeySpec = 1
Digital Signature, Key Encipherment
KeyUsage = 0xA0
ProviderName = "Microsoft RSA SChannel Cryptographic Provider".
ProviderType = 12
SMIME = FALSE
RequestType = CMC

[Extensions]
%szOID_SUBJECT_ALT_NAME2% = "{text}dns=%SERVER_FQDN%" %szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_KP_RDC_AUTH%"

Generating the key pair and the certificate request

Now a key pair and a certificate request can be generated using this information file. The creation is done on the computer as administrator via command line with the following command:

certreq.exe -new {information file}.inf {certificate request}.req

The certificate request now generated can be viewed if desired with the following command line command:

certutil -dump {certificate request}.req

Sending the certificate request to the certification authority

Sending a certificate request to a certification authority and collecting the issued certificate is described in the article "Send a manually created certificate request to a certification authority" described.

Installation of the issued certificate

The certificate can now be copied to the computer. It must now be installed in the certificate store and linked to the private key. This is done with the following command line command:

certreq -accept {certificate}

Activation of the certificate and subsequent function test

The assignment of the certificate to the Remote Desktop session host is described in the article "Manually assigning a Remote Desktop (RDP) certificate" described.

How to identify the currently used Remote Desktop certificate is described in the article "Identify the active Remote Desktop (RDP) certificate" described.

Manually requesting a Remote Desktop (RDP) certificate