Remote Desktop Gateway TLS Certificate: Replacing the Certificate Without Breaking RDP Access

By /

Remote Desktop Gateway (RD Gateway) uses TLS for two purposes: the HTTPS tunnel that wraps RDP traffic, and the authentication handshake for RD Gateway policies. When the certificate expires, remote employees and administrators who connect through RD Gateway lose access immediately. This article covers replacing the RD Gateway certificate using the RD Gateway Manager, PowerShell, and Group Policy for automatic certificate deployment.

How RD Gateway uses TLS

RD Gateway acts as a reverse proxy for RDP connections. Clients connect to RD Gateway on port 443 using HTTPS (TLS + HTTP). Inside that TLS tunnel, the RDP protocol is encapsulated. The certificate on RD Gateway is what clients see when they connect — it must be trusted by the connecting clients, and its CN/SAN must match the hostname clients use to connect.

RD Gateway’s certificate is installed in:

  • Windows Certificate Store: Cert:\LocalMachine\My
  • IIS: The “Remote Desktop Gateway” binding in IIS, or bound directly via the RD Gateway service

The RD Gateway service and IIS share the same certificate for port 443.

Certificate requirements

The certificate must:

  • Have the Server Authentication EKU
  • Have a CN or SAN matching the public hostname clients use (e.g., rdgateway.example.com)
  • Be installed in Cert:\LocalMachine\My on the RD Gateway server
  • Be signed by a CA that clients trust (Active Directory root CA or a public CA)
  • Have a minimum 2048-bit RSA key

Step 1: Import the new certificate

From a PFX file

$pfxPassword = ConvertTo-SecureString -String "PFXpassword" -AsPlainText -Force
$cert = Import-PfxCertificate `
    -FilePath "C:\Certs\rdgateway.example.com.pfx" `
    -CertStoreLocation "Cert:\LocalMachine\My" `******

Write-Host "Imported certificate thumbprint: $($cert.Thumbprint)"

From AD CS (internal CA)

$cert = Get-Certificate `
    -Template "WebServer" `
    -SubjectName "CN=rdgateway.example.com" `
    -DnsName "rdgateway.example.com" `
    -CertStoreLocation "Cert:\LocalMachine\My"

Write-Host "Certificate thumbprint: $($cert.Certificate.Thumbprint)"

Step 2: Update the RD Gateway certificate using RD Gateway Manager

  1. Open Remote Desktop Gateway Manager (tsgateway.msc).
  2. Right-click the server name in the left panel → Properties.
  3. Go to the SSL Certificate tab.
  4. Click Select an existing certificate for SSL encryption (recommended).
  5. Click Browse Certificates.
  6. Select the new certificate from the list.
  7. Click Apply and then OK.

RD Gateway Manager restarts the RD Gateway service to apply the change.

Step 3: Update the certificate using PowerShell (preferred for automation)

# Get the new certificate thumbprint
$newThumbprint = (Get-ChildItem Cert:\LocalMachine\My | 
    Where-Object {$_.Subject -like "*rdgateway.example.com*"} | 
    Sort-Object NotAfter -Descending | 
    Select-Object -First 1).Thumbprint

Write-Host "New thumbprint: $newThumbprint"

# Update the RD Gateway configuration
Import-Module RemoteDesktopServices

Set-Item -Path "RDS:\GatewayServer\SSLCertificate\Thumbprint" -Value $newThumbprint

# Restart the RD Gateway service to apply
Restart-Service TSGateway

Get-Service TSGateway | Select-Object -Property Status, Name

Verify the certificate is now in use:

Get-Item "RDS:\GatewayServer\SSLCertificate\Thumbprint" | Select-Object -Property Value

Step 4: Update the IIS binding (if RD Web is on the same server)

If you have RD Web Access on the same server, IIS also needs the certificate updated:

# Import the WebAdministration module
Import-Module WebAdministration

# Remove old binding and add new one
$port = 443
$siteName = "Default Web Site"

# Get current certificate hash
$currentBinding = Get-WebBinding -Name $siteName -Protocol https -Port $port

# Remove old SSL binding
Remove-WebBinding -Name $siteName -Protocol https -Port $port

# Add new SSL binding
New-WebBinding -Name $siteName -Protocol https -Port $port -SslFlags 0

# Assign the new certificate
$certPath = "IIS:\SslBindings\0.0.0.0!$port"
$cert = Get-Item "Cert:\LocalMachine\My\$newThumbprint"
$cert | New-Item $certPath -Force

# Restart IIS
Restart-Service W3SVC

Step 5: Verify the certificate change

Check which certificate is bound to port 443:

netsh http show sslcert ipport=0.0.0.0:443

Look for the Certificate Hash — it should match the new thumbprint.

Test from a remote machine:

# Check the certificate being served
openssl s_client -connect rdgateway.example.com:443 -servername rdgateway.example.com </dev/null 2>&1 \
  | openssl x509 -noout -subject -dates -issuer

Verify RDP connection works with a test user before announcing the change.

Configuring RD Gateway clients to trust the certificate

For internal CA certificates (AD CS)

Deploy the root CA to all client machines via Group Policy:

  1. Open Group Policy Management (gpmc.msc).
  2. Edit the Default Domain Policy (or a specific policy).
  3. Navigate to: Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities.
  4. Right-click → Import → import the internal CA root certificate.
  5. Apply the policy and run gpupdate /force on clients.

For public CA certificates

If the certificate is signed by a public CA (DigiCert, Sectigo, etc.), clients already trust it. No additional configuration is needed.

RDP file (.rdp) trust configuration

RDP files for RD Gateway connections should specify the gateway FQDN, not the IP:

full address:s:internal-server.corp.example.com
gatewayhostname:s:rdgateway.example.com
gatewayusagemethod:i:1

Users connecting via the RD Gateway Manager will be prompted to trust the certificate if the CA is not already trusted.

Automating certificate renewal with win-acme

For Let’s Encrypt certificates on Windows:

# Install win-acme (wacs.exe)
# Request a certificate and bind to RD Gateway

wacs.exe `
    --target manual `
    --host rdgateway.example.com `
    --store certificatestore `
    --certificatestore My `
    --installation script `
    --script "C:\Scripts\update-rdgateway-cert.ps1" `
    --scriptparameters "{CertThumbprint}"

Create C:\Scripts\update-rdgateway-cert.ps1:

param([string]$CertThumbprint)

Write-Host "Updating RD Gateway certificate to: $CertThumbprint"

Import-Module RemoteDesktopServices

try {
    Set-Item -Path "RDS:\GatewayServer\SSLCertificate\Thumbprint" -Value $CertThumbprint
    Restart-Service TSGateway
    Write-Host "RD Gateway certificate updated successfully"
} catch {
    Write-Error "Failed to update RD Gateway certificate: $_"
    exit 1
}

Monitoring certificate expiry

Create a scheduled task that alerts when the RD Gateway certificate is close to expiry:

# Script: Check-RDGatewayCertExpiry.ps1
$thumb = (Get-Item "RDS:\GatewayServer\SSLCertificate\Thumbprint").Value
$cert = Get-ChildItem "Cert:\LocalMachine\My\$thumb"
$daysLeft = ($cert.NotAfter - (Get-Date)).Days

Write-Host "RD Gateway certificate expires: $($cert.NotAfter) ($daysLeft days remaining)"

if ($daysLeft -lt 30) {
    # Send email alert (configure SMTP)
    Send-MailMessage `
        -To "admin@example.com" `
        -From "monitoring@example.com" `
        -Subject "RD Gateway certificate expires in $daysLeft days" `
        -Body "The RD Gateway certificate will expire on $($cert.NotAfter). Please renew it." `
        -SmtpServer "smtp.example.com"
}

Schedule via Task Scheduler to run weekly.

Handling the “certificate warning” in Remote Desktop Connection

When users connect through RD Gateway, they may see a certificate warning if:

  1. The CA is not trusted on the client → deploy CA via GPO
  2. The certificate CN/SAN does not match the gateway hostname → issue a new certificate for the correct hostname
  3. The certificate has expired → renew immediately

To suppress the warning for domain-joined machines via Group Policy:

  1. Go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Connection Client.
  2. Enable Do not allow passwords to be saved.
  3. Configure Specify SHA1 thumbprints of certificates representing trusted .rdp publishers.
  4. Add the certificate thumbprint to the trusted list.

Troubleshooting

ProblemCauseFix
Certificate was not found in RD Gateway ManagerCertificate not in LocalMachine\MyRe-import PFX to correct store location
RDP connections fail after cert changeTSGateway service not restartedRestart-Service TSGateway
Clients see security warningCA not trusted on clientDeploy CA root via GPO
Certificate CN mismatchUsers connecting to a different hostnameIssue certificate with correct SAN
The target principal name is incorrectCertificate CN/SAN does not match the gateway FQDN in the RDP fileEnsure SAN matches gatewayhostname in RDP file

Summary

RD Gateway certificate replacement requires importing the certificate into Cert:\LocalMachine\My, then updating the RD Gateway configuration via RD Gateway Manager GUI, PowerShell RDS module (Set-Item "RDS:\GatewayServer\SSLCertificate\Thumbprint"), and IIS if RD Web is co-hosted. Restart the TSGateway service after the update. For client trust, deploy the CA root certificate via Group Policy to all domain-joined machines. Monitor certificate expiry with a scheduled PowerShell script and automate renewal with win-acme.

Related Posts

Scroll to Top