No Support for SSL RDP?

avatar

So I came across a Server 2008 R2 box configured for RDP using SSL (TLS 1.0) for the security layer and FIPS 140-1 for encryption.
RDM does not connect and throws an error seen below. The MS RDP client has no issues connecting other than the certificate not being issued from a certificate authority. Any ideas?

6-27-2011 3-18-03 AM.png

All Comments (10)

avatar

Hi,
There is a setting in the Advanced Tab, Enable Network Level Authentication and the Authentication combobox, have you tried?
edited by dhervieux on 6/27/2011

David Hervieux

avatar

Well something is different now. I am unable to produce the error anymore.
Now, whether I use NLA or not the session does not connect and no error is produced. It just sits ther indefinately.
I can use the session if I select external. I cannot use the session if I choose embedded.
And I noticed something odd about the certificate warnings. I get two different certificate warnings depending on whether I use RDM or the MSRDP client. The order in which they appear is also different.
External Session: Certificate warning then logon screen.
MSRDP Client: Logon screen then certificate warning.
I dont know why they would be different if RDM is just using accessing the same client?

When_Using_An_External_Session.png

When_Using_The_MSRDP_Client.png

avatar

Hi,
yes and no, in external it's mstsc but in embedded, it's the ActiveX.

David Hervieux

avatar

Ok, that makes sense.
I could provide a server for testing with ssl enabled if you do not have one available.

avatar

Hi,
Yes if it's possible, I would like this.

David Hervieux

avatar

I sent you a PM.

avatar

I am doing my own experimentation with the server settings and it appears that when I enforce NLA on the server embedded connections stops connecting.

avatar

In contrast, if I do not enforce NLA and enable SSL I get the error in my first post. So it seems at leas the issue has nothing to do with the FIPS encryption level.

avatar

Ok, I just discovered that if you store the password, the certificate warning pops up. Then you get a prompt for another password.
This only works for external though. Try it on the ip I gave you.
edited by xcentric on 6/27/2011

avatar

Just to confirm, I did remove the NLA enforcement from the test server.