Nowadays, there is no buddy left in IT who didn’t work on a remote computer. This shows that how enormously the IT industries rely on the RDP service. This service has eased the life of IT professionals. It has given the freedom to manage the work from a central location. However, it has some caveats if we don’t manage it in a secure way. This service has raised several concerns to IT admins. The most prominent one is security. Considering the rising cybersecurity incidents, organizations need to manage the RDP services under the security umbrella. One of the most secure and easiest ways to manage network communications is encryption. Most of you know about HTTP(S) and how HTTP is secured using SSL/TLS encryption protocol. In the same way, RDP communications can also be secured using the SSL/TLS encryption protocol. To enable SSL/TSL encryption, we need to import RDP certificates on all the workstations and servers like HTTPS certificates. To have an RDP certificate, we should have an internal Certificate Authority deployed on the network with an RDP certificate template to issue RDP certificates for workstations and servers. Let’s look into how to create a template for an RDP certificate in this article.
How to Create a Template for RDP Certificate?
Time needed: 10 minutes.
How to Create a Template for RDP Certificate?
- Open Certificate Authority
Issue the ‘certsrv’ command on the CLI
- Open certificate management template
Right click on the ‘Certificate Template’.
- Create a duplicate template from “Computer” template
- General settings on RDP certificate template
Fill the Template Name, Validity, and Renewal Period in the general setting tab
- Compatibility settings on RDP certificate template
Choose ‘Windows Server 2003‘ in the Capability Authority dropdown and Windows XP/ Server 2003 in the ‘Certificate recipient‘ dropdown
- Request Handling settings on RDP certificate template
Set the Purpose to the ‘Signature and Encryption‘ and check the ‘Allow private key to be exported.
- Cryptography settings on RDP certificate template
Set these three settings in the cryptography settings tab.
Provider Category: Legacy Cryptography Service Provider
Algorithm name: Determined by CSP
Minimum Key Size: 1024 or 2048 as per Organisation security requirement.
Select the ‘Request must use one of the following providers‘
Click on ‘Microsoft RSA SChannel Cryptographic Provider
- Key Attestation settings on RDP certificate template
The Key Attestation tab should look like the one below
- Server settings on RDP certificate template
It should be like this
- Application Policies settings on RDP certificate template
Go to ‘Extensions‘
Edit the ‘Application Policies‘.
Remove the Server Authentication and Client Authentication Policies to the Application Policy.
Click Add -> New
Enter ‘Remote Desktop Authentication‘ in the name and ‘1.3.6.1.4.1.311.54.1.2′ in the Object identifier
- Application policy in Extension settings on RDP certificate template
Application policy should look like this
- Subject Name settings on RDP certificate template
Select ‘Supply in the request‘
- Issuance requirements settings on RDP certificate template
Your Issuance requirements should be like this
- Issue the certificate template
After creating the certificate template issue the template.
1. Right Click on Certificate Template
2. Click New
3. Click Create Template to issue
The RDP certificates can be distributed across the organizations using GPO policies. We will try covering the GPO settings in another post as we don’t have the GPO configured at the time of creating this post.
Thanks for reading this post. We believe we have answered the question ‘how to create a template for an RDP certificate on an internal certificate authority. In the next post, we will show how to get the RDP certificate from the CA, how to deploy the certificate and bind it to the RDP services.
