Self assigned or trusted certificate for no Gateway scenario

hi,
1. RDS server 2012 R2 is deployed and I can access published app by
https://servername/rdweb
2. RD Gateway will be never used (only LAN connections)
3. Would self signed certificate prevent to achieve THE GOAL:
need to publish an app by providing shortcut on user desktop in completely transparent for user manner.
There is no problem with purchasing a Trusted certificate. I thought that trusted will be necessary (less hassle) if RD Gateway is in place. But still have a feeling that even for publishing a shortcut there will be some pop up after user click on an icon
if Self Assigned will be present.
Please clarify.
Thanks.
"When you hit a wrong note it's the next note that makes it good or bad". Miles Davis

Hi,
Thank you for posting in Windows Server Forum.
As per my research, I can say that to work with RemoteApp we must have trusted certificate. By default, the self-signed certificate is not a trusted certificate, and self-signed certificates are recommended only for testing and evaluation purposes. We must
need to purchase trusted certificate from trusted root certification authority. After we have obtained a trusted certificate for the RD Web Access server, we must import the certificate onto the RD Web Access server, and then use the Internet Information Services
(IIS) Manager tool to associate the certificate with the RD Web Access Web site.
More information.
About RemoteApp and Desktop Connection Security
http://technet.microsoft.com/en-us/library/ee216760.aspx
Certificate Requirements for Windows 2008 R2 and Windows 2012 Remote Desktop Services
http://blogs.technet.com/b/askperf/archive/2014/01/24/certificate-requirements-for-windows-2008-r2-and-windows-2012-remote-desktop-services.aspx
Hope it helps!
Thanks.
Dharmesh Solanki

Similar Messages

Where can I get a trusted certificate for free?

Is there any service that allows me to get a trusted certificate (so my devices aren't showing that the certificate is invalid) for free? I already have one from StartSSL but it still says that is it not from a trusted certificate authority.

If these are your own clients and servers, or these are clients where you can load and trust your own root certificate, then you can set up your own certificate authority.
If you're planning on web commerce or similar, then you're unfortunately going to end up purchasing a certificate in order to protect your customers' network traffic against eavesdropping.

Trusted Certificates for iMac

Are certificates from other countries trusted if they are allowed access to all your apps?

Hello,
It should works with browser keystore, here are something I can think of:
1. When you import CA into IE browser, make sure it is in the right keystore (Trusted CA) and select options to let this CA do signing verification.
2. Make sure the certificate chain which signing the jar file does't miss any intermediate certificate, otherwise you have to import intermediate certificate into IE browser as well.
Dennis

Why, when I successfully connect to Server 2012 Essentials R2 via Anywhere Access does the Remote Desktop Connection use the self signed certificate for RDP instead of the SSL certificate I installed when I set up access anywhere?

Scenario:
Windows Server 2012 R2 Essentials
I purchased an SSL Cert from GoDaddy and I managed (after some challenges) to set up Anywhere access to use that new SSL Cert. I to rebooted the server and I am able to login to Anywhere Access vis https (using the SSL certificate) from PC, Mac and iOS.
So far so good.
The problem I am having is that when I click to launch a remote desktop connection to the server RDP connection wants to use the self signed SSL certificate of the server rather than the SSL Certificate I installed into Anywhere Access. As a result, I get
a security warning like this: "The identity of the remote computer cannot be verified. Do you want to connect anyway?"
The name in the certificate appears as ACME-SERVER.ACMEDOMAIN.local instead of the SSL Certificate I installed, which is
remote.acmedomain.com
If I lick to accept, RDP does work fine, it;s just using a self signed certificate. I want it to use the trusted certificate that I purchased and installed.
My guess is that there must be an additional step to tell Anywhere Access that when it generates the RDP session that it should use the cert? OR, is this just how it works?

Because....
the server does not have a 'trusted' certificate assigned to it.
Only the RDP Gateway has the trusted certificate for the external name.
If you want to remove that error, you have to do one of the following:
Make sure your domain uses a public top level domaim, and get a public trusted certificate for your server.
So, something like,
server.domain.publicdomain.com
Or,
Install that certificate on your remote computer so it is trusted.
Robert Pearman SBS MVP
itauthority.co.uk |
Title(Required)
Facebook |
Twitter |
Linked in |
Google+

IMac self assigning IP addresses to both Airport and Ethernet, randomly

So, I've seen some others complain about their Macs randomly dropping the internet since around the 10.6.6 update. I've had the same issue. Sometimes it will go days with no problems, other times I have to reboot the iMac multiple times a day because it won't stay connected to the internet.
I finally looked in my network part of my System Preferences to see what that said, and to my shock I found that when the iMac deops from the network (the only thing on the network that drops, cell phones on WiFi are fine, Windows computers are fine, PS3 and Xbox 360 are fine) that it tells me that it has self assigned the IP addresses for the AirPort and/or Ethernet port.
Before I discovered this, my one friend joked it was a user error (PBKAC), but now that I can confirm it is not, I know this to be an OS X problem. Somewhere along the way to the 10.6.6 update, someone at Apple did something to the TCP/IP stack that seems to randomly affect users, and it has not been fixed, since.
Telling the computer to renew the DHCP lease from the router works sometimes, but not all the time. When it doesn't work, then the iMac needs to be rebooted in order to reconnect to the network.
I have a video showing the issue, as well. http://youtu.be/dhncotyiqS0
Apple, you need to fix this problem, even though it appears to not affect all users all the time.

Hello djhalnon. Welcome to the Apple Discussions!
At any rate, while the Netgear had a "LAN IP Setup" screen allowing me to specify device addresses assigned by its DHCP service, I haven't found any such thing in the Airport Utility. Searching the 'Net didn't help much, because what I found doesn't coincide with what I can do in the utility.
The "equivalent" for the AirPort would be to utilize the "Reserve a DHCP IP address" feature in the AirPort Utility.
To do this, select the Manual Setup option in the AirPort Utility, and then:
1. Reserve a DHCP-provided IP address for the host device.
Internet > DHCP tab
o On the DHCP tab, click the "+" (Add) button to enter DHCP Reservations.
o Description: <enter the desired description of the host device>
o Reserve address by: MAC Address
o Click Continue.
o MAC Address: <enter the MAC (what Apple calls Ethernet ID if you are using wired or AirPort ID if wireless) hardware address of the host computer>
o IPv4 Address: <enter the desired IP address>
o Click Done.

50.28.68.31:2087 uses an invalid security certificate. The certificate is not trusted because it is self-signed. The certificate is only valid for a id="cert_

50.28.68.31:2087 uses an invalid security certificate.
The certificate is not trusted because it is self-signed.
The certificate is only valid for <a id="cert_domain_link" title="new.thelifeincomegroup.com">new.thelifeincomegroup.com</a>
(Error code: sec_error_untrusted_issuer)

See https://support.mozilla.org/kb/Secure+Connection+Failed

Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
on this computer" and un-checked "Use simple certificate selection".
My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
drop down.
Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
TIA,
-Rick

Hi Rick,
Thank you for your patience.
According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
Best regards,
Steven Song
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Why ASA creates self assigned certificate on each reboot

Hi Everyone,
I noticed
"By default, the security appliance has a self-signed certificate that is regenerated every time the device is rebooted. We can purchase your own certificate from vendors, such as Verisign t, or you can configure the ASA to issue an identity certificate to itself. This certificate remains the same even when the device is rebooted.
Need to know the reason behind the creation of self assigned certificate on each reboot?
Regards
MAhesh

Hello Mahesh,
As you mention that's by default and by desing,
That would help us in the case we set a SSL session to the box (Anyconnect, ASDM) as we will not need to go a step further and manually create or generate an SSL certificate,
Why?
Because the firewall will do it automatically, altough if you purchase one from a CA you can overwrite it by installing the certificate and set it as the SSL certificate for any SSL session,
For Networking Posts check my blog at http://laguiadelnetworking.com/
Cheers,
Julio Carvajal Segura

About self-signed (sign_webutil.bat) certificates, CA for ISV

Hi all.
Currently using 11g rel2.
I'm getting deeply concerned about issues related to self signed certificates and the way Oracle Forms Java Client will behave in future java updates.
Since every application will probably have their own jar files: for example jars for deployment of icon files, or probably some provided by third parties, such as calendar bean, google map bean, etc. one must provide the best deployment scenario for your owned developed applications.
Another issue that arises, is the java auto update feature, meaning that is hard to control which java version a given client actually has or might be running.
Coming from Oracle Forms background, this jar signing issues really become a pain in the ... So, I'd like to ask for some guidance for experts from this community.
1) Possibly the best situation will be to have all jar files signed from a CA. If this is the case, a couple of questions:
    1.1) If you are an ISV, who should by the CA software?. From the way i see it, is the ISV who provides the solution, and as part of this solution, apart from the Forms Application, would be to deliver trusted jar files.
   1.2) What happens if jar files come from different CAs?. For examples, Oracle provided files are already signed. What happens with your own jars files?. Will this be an issue? I've heard all files specified on the archive must share the same certificate. Is this true?
1.3) Apart from VeriSign, where can i find other cheaper CAs?
2) Although this might not be the best solution, can one lock or force forms client to use a lower JRE?. One that does not have many security enforcement?.
Help will be greatly appreciated.....!!!!

I'll offer my thoughts on your questions...
1) Possibly the best situation will be to have all jar files signed from a CA. If this is the case, a couple of questions:
    1.1) If you are an ISV, who should by the CA software?. From the way i see it, is the ISV who provides the solution, and as part of this solution, apart from the Forms Application, would be to deliver trusted jar files.
   1.2) What happens if jar files come from different CAs?. For examples, Oracle provided files are already signed. What happens with your own jars files?. Will this be an issue? I've heard all files specified on the archive must share the same certificate. Is this true?
1.3) Apart from VeriSign, where can i find other cheaper CAs?
1.1 - As an Independent Software Vendor (ISV) I would expect the cost of the CA to be included in the price of the software. You want to make the customer's experience as easy and trouble-free as possible.
1.2 - No, this is not an issue. Our Forms application (even though it is an internally used application and is not publicly licensed) uses .jar files that we have created and signed with our own trusted certificate. Oracle doesn't care if the jar files are not signed by the same certificate...only that they are signed by a trusted certificate.
1.3 - Well, I just did a simple GOOGLE search and found this web site, which reviews serveral certificate issuers. SSL Certificate Reviews.
Hope this helps.
Craig...

Help for "obtain a trusted certificate" doesn't help

In particular the following text in the Help Center:
Select your server in the sidebar, and then click Settings.
Click the Edit button at the right of SSL Certificate.
From the Action pop-up menu (looks like a gear), choose Manage Certificates.
In the Manage Certificates pane, select the self-signed certificate you want to use to generate the CSR.
From the Action pop-up menu (looks like a gear), choose Generate Certificate Signing Request (CSR).
Save the CSR file.
I'm running the Server app. (This is the right thing, yes?) 2.2.1 First step works fine. But there doesn't seem to be an "Edit button" at the right of SSL Certificate. Or an SSL Certificate. But I seem to recall MAKING a certificate, yes... I see it now. Under the Certificates selection in the sidebar. But no "manage certificates" or some such. But I THOUGHT I saw such a thing... somewhere...

Ah... Thanks for both points. I was specifically looking for a "request trusted certificate" path, which the Keychain tool didn't (explicitly) show me, though it DID show a whole slew of certificates that I never knew I had (nor understand exactly what they are about, but, "I am but an egg" on these things.)
Back on the Server app, it is the + button on the certificates field, so correct documentation might be something along the lines of...
Select "Certificates" under the "Server" group on the sidebar.
Click the "+" at the bottom of the server list.
Select "Get a Trusted Certificate" from the pop-up menu.
... (I'll know better when I actually perform the steps)
I hope this will advance the cause.

Suddenly getting a warning about a self issued certificate for a secure connection failure..is this a spoof?

when starting up firefox, our fortigate firewall has started issuing a warning..
"Secure connection failed- s-static.ak.fbcdn.net:443 uses of invalid security certificate. The certificate is not trusted because it is self signed. The certificate is valid for FGT50B3G10615174 Fortinet. (Error code: sec_errror_ca_cert_invalid). This could be a problem with the server's configuration or it could be someone trying to impersonate the server.
If you have connected to the server successfully i the past the error may be temporary and you can try it again later."
This error is coming up on more than one computer when going into Firefox.

Try to disable secure connection in Facebook.
*[https://www.facebook.com/settings?tab=security#!/settings?tab=security&section=browsing&t]

I can't connect to my school's free wifi. i was able to do it before but not anymore i get the self assign ip agrees message .it has no password only a pop up window before you connect to agree to school terms for wifi use. i don't get that window anymore

I can't connect to my school's free wifi. i was able to do it before but not anymore i get the self assign ip addrees message .it has no password only a pop up window before you connect to agree to school terms for wifi use. i don't get that window anymore. i tried everything I can think of. It is a 2010 macbook pro but i recentrly updated to osx lion and even with lion it was working fine so I nkow it is not the update. also Im able to connect to other internets at home it works great. starbucks too. but i became so frustated that i reset my computer to manufactuter setting and reinstall snow leopard on it. still I cant connect. I need help please i have been searching all over the web for help and i see people has been having this same problem for years now.. oh yeah and i know it is not the internet cuz there are other macs connecting to it without a single problem so i think it is an isolated problem plase help....i have follow many advises such as delete the internet from your prefered netwoks. restar your commputer etc etc.

Be sure Safari does not have the Block Pop-Up Windows preference set.
Where I work now there are several unencrypted VLANs that require authentication, and Safari promptly pops up a window for me to register every time.

Hey, for some reason i turned on my macbook pro 2012 and it says i have no internet access. I then found out that it also says that my self assigned ip address will not connect to the internet. How is this and how can i fix it?

hey, for some reason i turned on my macbook pro 2012 and it says i have no internet access. I then found out that it also says that my self assigned ip address will not connect to the internet. How is this and how can i fix it?

Reset your modem.

Failed to create machine self-signed certificate for site role [SMS_SQL_SERVER]

SCCM 2012 has been successfully installed on the server:
SRVSCCM.
The database is on SQL Server 2008 R2 SP1 CU6 Failover Cluster (CLS-SQL4\MSSQLSERVER04)
Cluster nodes: SQL01 and SQL01. On all nodes made necessary the Security Setup of SCCM. No errors and warning on SCCM Monitoring.
The cluster service is running on the account: sqlclusteruser
The account has the appropriate SPN are registered:
setspn -L domain\sqlclusteruser
Registered ServicePrincipalNames for CN=SQL Cluster,OU=SQL,OU=Users special,OU=MAIN,DC=domain,DC=local:
MSSQLSvc/CLS-SQL4
MSSQLSvc/CLS-SQL4.domain.local
MSSQLSvc/CLS-SQL4:11434
MSSQLSvc/CLS-SQL4.domain.local:11434
After some time on the cluster hosts every day started appearing new folders with files inside:
srvboot.exe
srvboot.ini
srvboot.log
srvboot.log contains the following information:
SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER started.
Microsoft System Center 2012 Configuration Manager v5.00 (Build 7711)
Copyright (C) 2011 Microsoft Corp.
Command line: "SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER CAS K:\SMS_SRVSCCM.domain.local_SMS_SQL_SERVER8 /importcertificate SOFTWARE\MicrosoftCertBootStrap\ SMS_SQL_SERVER".
Set current directory to K:\SMS_SRVSCCM.domain.local_SMS_SQL_SERVER8.
Site server: SRVSCCM.domain.local_SMS_SQL_SERVER.
Importing machine self-signed certificate for site role [SMS_SQL_SERVER] on Server [SQL01]...
Failed to retrieve SQL Server service account.
Bootstrap operation failed: Failed to create machine self-signed certificate for site role [SMS_SQL_SERVER].
Disconnecting from Site Server.
SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER stopped.

The site server is trying to install the sms_backup agent on the SQL Server Cluster nodes.
Without successfull bootstrap the siteserver backup is not able to run successfully.
Try grant everyone the read permisson on
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS on the SQL server nodes.
This worked for me.
After that a Folder named "SMS_<SITESERVER-FQDN>" appeared on C: on the SQL Cluster nodes, and a "SMS_SITE_SQL_BACKUP_FQDN" Service should be installed.
After the new Folder is created and the new Service is installed, you can safely remove the bootstrap Service by opening a command prompt and enter:
sc delete "SMS_SERVER_BOOTSTRAP_FQDN-of-SiteServer_SMS_SQL_SERVER"

Why does my Airport Express say "self assigned IP address"? No IP address for the ethernet, and it is not connecting to my cable router any longer...

Why does my Airport Express say "self assigned IP address"? No IP address for the ethernet, and it is not connecting to my cable router any longer...

Some cable providers.....like mine, a well known company......seem to take anywhere from a few moments to sometimes up to 30 minutes to allow their equipment back at the cable company to fully reset and issue a new fresh connection.
So, it would not hurt to leave things powered down for 15-20 minutes or more when you perform the reset that John Galt suggests.

Self assigned or trusted certificate for no Gateway scenario

Similar Messages

Maybe you are looking for