With Microsoft RDP client, how do I mark a particular server certificate as trusted?

Question

I am using Microsoft's RDC client on Mac OS X, to connect to a Windows server. I am connecting to a RDC server that uses a self-signed certificate to identify itself. As a consequence, when I connect, my RDC client gives me a warning dialog like this:

I can click "Connect" to continue, but then I have no security against man-in-the-middle attack, because "Connect" instructs my client to ignore the server cert. I want to continue to connect, but in a way that is secure.

Another option is to go to the Microsoft RDC client's preferences pane:

and switch to "Always connect, even if authentication fails". This way, I'm never shown the warning again: it's as if I automatically clicked "Connect" every time. However, again, this is not secure: it skips authenticating the server, and thus is vulnerable to man-in-the-middle attacks.

I want to be secure. Therefore, neither of the two approaches above is satisfactory.

Conceptually, the obvious path forward is to somehow gain access to the server's self-signed certificate, and then ask the RDC client to treat it as trusted and never warn me about that certificate again. This would be secure (like SSH). However, I can't figure out how to get my RDC client to do that.

How do I arrange for this server's certificate to be treated as trusted (despite the fact that it is self-signed), and have the system never warn me about connections that use that particular certificate, but still provide security (e.g., warn me if the certificate changes)?

Answer 1

I looked into this a bit, and in my case the issue was on the RDP Server side. The certificate it was using was actually a self-signed, automatically generated one that was not signed by my local CA's root certificate. It thus didn't matter where I put the root cert, I always got the pop-up saying "The Certificate is not trusted..."

I installed the root cert from my local CA in the System keychain and set it to Always Trust, then on the Windows Server side, using Administrative Tools -> Remote Desktop Services -> Remote Desktop Session Host configuration, I updated the certificate assigned to the RDP-Tcp connection. Right-click RDP-Tcp Connection, choose Properties. On the General tab, see at the bottom there's a link labelled "Auto-generated"

(see an image of the pane here: http://www.windowsecurity.com/img/upl/image0021281709633474.jpg)

That's the self-signed certificate. Clicking Select lets you choose any other certificate already on the machine. Once that change was made, the prompt was gone from the client side on the next login.

Hope this helps (though it really only helps if you have admin access on the Windows side...)

Answer 2

Adding to the System keychain, set to "Always trusted", worked like a charm for me.