How to Install or Renew an RD Gateway SSL Certificate
RD Gateway clients need to verify the identity of the server they reach. An expired certificate, a missing private key or a certificate for the wrong DNS name can stop the connection before the user reaches a desktop.
The management console labels this an SSL certificate, although supported deployments use TLS. These steps cover an initial installation and a planned renewal of the gateway certificate.
Before You Begin
- Administrator access to the gateway and, if applicable, the RDS deployment.
- A valid certificate covering the public gateway name, such as rdg.example.com; use your real name.
- A password-protected PFX containing the certificate and private key, with the appropriate issuing CA chain available.
- An external test client and a maintenance window if a service restart becomes necessary.
-
Check the name and certificate purpose
Compare the hostname entered in your clients' gateway settings with the certificate's Subject Alternative Name. The certificate must cover that hostname and be valid for Server Authentication. Check its start and expiration dates.
Keep the gateway address consistent across clients. A certificate for a public hostname will not normally validate a connection made to the server's private IP address.
-
Prepare the certificate and private key
Obtain or renew the certificate with your certificate authority, then export it with its private key as a .pfx file. A public .cer file alone does not contain the private key required by the gateway.
Protect the PFX password and restrict access to the file. Clients need to trust the issuing CA; they should never receive the gateway's private key. For private PKI, deploy the trusted root and intermediate certificates through your organization's managed process.
-
Import and assign the certificate
On the gateway, open RD Gateway Manager, right-click the server and select Properties → SSL Certificate. Choose the certificate import option, browse to your PFX and supply its password.
Apply the selection. Check the certificate displayed in the gateway properties. Simply copying the PFX onto the server or importing it into a certificate store is not enough to confirm the gateway is using it.
-
Update the deployment where applicable
For a gateway managed as part of an RDS deployment, open Server Manager → Remote Desktop Services → Overview → Tasks → Edit Deployment Properties → Certificates. Select the RD Gateway role and assign the renewed certificate.
Review RD Web Access and the Connection Broker separately. Their certificate assignments are separate roles, even when some roles share a server or certificate. Update them only when the certificate is intended for those names and purposes.
-
Check every gateway endpoint
On a farm, confirm each serving gateway has the intended certificate and private key. If a load balancer terminates TLS, check its certificate configuration too; renewal on one Windows server does not necessarily update the public endpoint.
Record the new certificate's thumbprint and expiry, then compare them with the active configuration. If the console requests a service restart, schedule it because active sessions may be interrupted.
-
Test a new external session
Open a fresh Remote Desktop connection from outside the network using the public gateway name. Verify that the gateway certificate is trusted and that the target session opens. Test the published connection too, if users access a collection.
A browser check can help inspect an HTTPS endpoint, but it does not validate the entire RDP-through-gateway path. Keep the previous working certificate available until verification is complete, then handle old keys according to your retention policy.
RD Gateway certificate checks
| Symptom | Check first |
|---|---|
| Certificate name warning | The client gateway name is covered by the certificate's SAN. |
| Certificate is not available for selection | The certificate is in the intended store and has its private key. |
| Clients still see the previous certificate | Active gateway assignment, other farm nodes and any TLS terminator. |
| Only some clients report an untrusted issuer | Their trust chain, system time and access to certificate validation endpoints. |
Frequently Asked Questions
Yes, when every connecting client trusts its issuing chain. A publicly trusted certificate generally simplifies access from devices you do not centrally manage.
Admin Strategy: Schedule renewal before expiry and include an external connection test in the change record. Treat the PFX and its password as sensitive credentials
Review Your Remote Desktop Licensing
Certificates secure the gateway connection. If you are also expanding an RD Session Host deployment, review the RDS CALs required for its users or devices.
Author Bio
Microsoft Certified Professional
With over 20 years of experience deploying and managing enterprise Windows Server environments, Keloth leads technical implementation at RDS CAL Store. He specializes in Remote Desktop Services infrastructure, secure remote architecture, and helping IT teams seamlessly scale their official licensing.
Related Posts
Understanding RDS CAL Downgrade Rights
Home – Understanding RDS CAL Downgrade Rights Understanding RDS CAL Downgrade Rights When managing a Remote Desktop Services environment, hardware and software upgrades rarely happen all at once. You might purchase new Client Access Licenses (CALs) today, but still need them to authorize connections to older servers running in your datacenter. Microsoft accommodates this reality…
How to Disable Remote Desktop Easy Print in Windows Server (2016-2025)
Home – How to Disable Remote Desktop Easy Print in Windows Server (2016-2025) How to Disable Remote Desktop Easy Print in Windows Server (2016-2025) Remote Desktop Easy Print is the default driver Windows uses to map local client printers into a remote session. While convenient, it strips away advanced printer features (like stapling, tray selection,…
How to Create a Remote Desktop User in Windows Server (2016, 2019, 2022 & 2025)
Home – How to Create a Remote Desktop User in Windows Server (2016, 2019, 2022 & 2025) How to Create a Remote Desktop User in Windows Server (2016, 2019, 2022 & 2025) Provisioning remote access for a new employee requires more than just creating a standard Windows account. To securely connect to a Session Host,…
How to Fix the CredSSP “Encryption Oracle Remediation” RDP Error
Home – How to Fix the CredSSP “Encryption Oracle Remediation” RDP Error How to Fix the CredSSP “Encryption Oracle Remediation” RDP Error If you are managing Windows Servers, you have likely encountered this terrifying error message when trying to connect via Remote Desktop: “An authentication error has occurred. The function requested is not supported… This…