How to Create a Template for RDP Certificate in a Local Certificate Authority?

Nowadays, there is no buddy left in IT who doesn’t work on a remote computer. This shows how enormously the IT industries rely on the RDP service. This service has eased the life of IT professionals. It has given me the freedom to manage the work from a central location. However, it has some caveats if we don’t manage it in a secure way. This service has raised several concerns to IT admins. The most prominent one is security. Considering the rising cybersecurity incidents, organizations need to manage the RDP services under the security umbrella. One of the most secure and easiest ways to manage network communications is encryption. Most of you know about HTTP(S) and how HTTP is secured using SSL/TLS encryption protocol. In the same way, RDP communications can also be secured using the SSL/TLS encryption protocol. To enable SSL/TSL encryption, we need to import RDP certificates on all the workstations and servers like HTTPS certificates. To have an RDP certificate, we should have an internal Certificate Authority deployed on the network with an RDP certificate template to issue RDP certificates for workstations and servers. Let’s look into how to create a template for an RDP certificate in this article.

How to Create a Template for RDP Certificate?

Step 1. Open Certificate Authority

Issue the ‘certsrv’ command on the CLI

Step 2. Open certificate management template

Right-click on the ‘Certificate Template’.

Step 3. Create a duplicate template from the “Computer” template

Step 4. General settings on the RDP certificate template

Fill in the Template Name, Validity, and Renewal Period in the general setting tab

Step 5. Compatibility settings on the RDP certificate template

Choose ‘Windows Server 2003‘ in the Capability Authority dropdown and Windows XP/ Server 2003 in the ‘Certificate recipient‘ dropdown

Step 6. Request Handling settings on the RDP certificate template

Set the Purpose to the ‘Signature and Encryption‘ and check the ‘Allow private key to be exported.

Step 7. Cryptography settings on the RDP certificate template

Set these three settings in the cryptography settings tab.
Provider Category: Legacy Cryptography Service Provider
Algorithm name: Determined by CSP
Minimum Key Size: 1024 or 2048 as per Organisation security requirement.

Select the ‘Request must use one of the following providers‘Click on ‘Microsoft RSA SChannel Cryptographic Provider

Step 8. Key Attestation settings on the RDP certificate template

The Key Attestation tab should look like the one below

Step 9. Server settings on the RDP certificate template

It should be like this

Step 9. Application Policy settings on the RDP certificate template

Go to ‘Extensions‘Edit the ‘Application Policies‘.
Remove the Server Authentication and Client Authentication Policies to the Application Policy.Click Add -> New
Enter ‘Remote Desktop Authentication‘ in the name and ‘1.3.6.1.4.1.311.54.1.2′ in the Object identifier

Step 10. Application policy in Extension settings on RDP certificate template

Application policy should look like this

Step 11. Subject Name settings on RDP certificate template

Select ‘Supply in the request‘

Step 12. Issuance requirements settings on the RDP certificate template

Your Issuance requirements should be like this

Step 13. Issue the certificate template

After creating the certificate template issue the template.1. Right Click on Certificate Template
2. Click New
3. Click Create Template to issue

The RDP certificates can be distributed across the organizations using GPO policies. We will try covering the GPO settings in another post as we don’t have the GPO configured at the time of creating this post.

Thanks for reading this post. We believe we have answered the question ‘how to create a template for an RDP certificate on an internal certificate authority. In the next post, we will show how to get the RDP certificate from the CA, and how to deploy the certificate and bind it to the RDP services.

You may also like these articles: