So I came across a Server 2008 R2 box configured for RDP using SSL (TLS 1.0) for the security layer and FIPS 140-1 for encryption.
RDM does not connect and throws an error seen below. The MS RDP client has no issues connecting other than the certificate not being issued from a certificate authority. Any ideas?
6-27-2011 3-18-03 AM.png
Hi,
There is a setting in the Advanced Tab, Enable Network Level Authentication and the Authentication combobox, have you tried?
edited by dhervieux on 6/27/2011
David Hervieux
Well something is different now. I am unable to produce the error anymore.
Now, whether I use NLA or not the session does not connect and no error is produced. It just sits ther indefinately.
I can use the session if I select external. I cannot use the session if I choose embedded.
And I noticed something odd about the certificate warnings. I get two different certificate warnings depending on whether I use RDM or the MSRDP client. The order in which they appear is also different.
External Session: Certificate warning then logon screen.
MSRDP Client: Logon screen then certificate warning.
I dont know why they would be different if RDM is just using accessing the same client?
When_Using_An_External_Session.png
When_Using_The_MSRDP_Client.png
Hi,
yes and no, in external it's mstsc but in embedded, it's the ActiveX.
David Hervieux
Ok, that makes sense.
I could provide a server for testing with ssl enabled if you do not have one available.
Hi,
Yes if it's possible, I would like this.
David Hervieux
I sent you a PM.
I am doing my own experimentation with the server settings and it appears that when I enforce NLA on the server embedded connections stops connecting.
In contrast, if I do not enforce NLA and enable SSL I get the error in my first post. So it seems at leas the issue has nothing to do with the FIPS encryption level.
Ok, I just discovered that if you store the password, the certificate warning pops up. Then you get a prompt for another password.
This only works for external though. Try it on the ip I gave you.
edited by xcentric on 6/27/2011
Just to confirm, I did remove the NLA enforcement from the test server.