Certificate Requirement for Microsoft RDS 2012

Question

Hi All,
I planning to deploy RDS VDI and remote app service, Please help me to understand the certificate
requirement for server authentication, publication, SSO , etc.
Internet URL is
https://RDSVDI.domain.net
My servers are in .local 
RD Licensing Server--------RDSLICSVR.Domain.LOCAL
RD Connection Broker-----RDSCB.Domain.LOCAL
RD Web Access------------RDSWEBSVR.Domain.LOCAL
RD Session Host-----------RDSSHSVR.Domain.LOCAL
RD Visualization Host-------RDSVHSVR.Domain.LOCAL
RD Gateway Server -------RDGWSVR.Domain.LOCAL
What kind of Certificate do i required to launch Desktop and RemoteApp without any error.

Answer 1

Hi,
1. I would recommend a wildcard certificate (*.domain.net) purchased from a trusted public authority such as GoDaddy, VeriSign, Thawte, etc.  This wildcard certificate would be used for all RDS purposes.
2. On the internal network you will need to create a DNS zone for domain.net with A records pointing to the private ip addresses, similar to the following:
rdsvdi.domain.net --> private ip address of your RD Web server
rdscb.domain.net --> private ip address of your RD Connection Broker
rdsgwsvr.domain.net --> private ip address of your RD Gateway server (this is only needed if you want to use RDG for internal users)
3. On the Internet you will need DNS records similar to the following:
rdsvdi.domain.net --> public ip address for your RD Web server
rdgwsvr.domain.net --> public ip address for your RD Gateway server
4. You will need to change the published FQDN for your RDS deployment to rdscb.domain.net using the cmdlet below:
Change published FQDN for Server 2012 or 2012 R2 RDS Deployment
http://gallery.technet.microsoft.com/Change-published-FQDN-for-2a029b80
5. You may need to modify your RD RAP in RD Gateway Manager. For example, you could edit the properties of the RD RAP, Network Resource tab, and select Allow users to connect to any network resource.
6. You should make sure that all client PCs have RDP 8.1 Client (6.3.9600) installed for best results connecting to Server 2012 R2.
7. For domain-joined PCs you may choose to set the SHA thumbprint of your certificate via group policy setting so that they will not be prompted when launching RemoteApps.
8. It is preferred for users to use IE to connect to RD Web Access and select the Private option if possible (as long as the PC is not public).  When prompted they should Allow the Activex control to run.
-TP