This GUI program lets you choose the certificate to encrypt your Remote Desktop Services connections.

In Windows Server 2008 R2 and earlier, this functionality was available in the Remote Desktop Session Host Configuration (tsconfig.msc). However, Microsoft deleted this file from Windows Server 2012 and later, which means you can only configure it programmatically using WMI. This program restores the graphical certificate choice functionality that was removed.

Thanks to major web browser vendors needlessly bullying certificate authorities into restricting the maximum validity period of certificates to roughly 1 year, I now have to deal with this problem far more often than if I could just buy a 5-year cert, install it once, and then not think about it for a long time. This change makes no sense: my owner checks are simply using domain validation, which is just a simple proof of DNS control and does not guarantee much of anything; key rotation is not more frequent because you are not required to generate a new private key or certificate signing request, just a public cert; and all of the improvements over time in public key cryptography come from the protocols which use the certificates, not the certs themselves, such as Apache httpd and Nginx implementing HTTP/2, TLS 1.3, and improved cipher suites.

1. Requirements
2. Installation
3. Certificate Conversion
4. Usage
5. Validation

• Windows
  • Tested on Server 2019
  • Should work on any other versions too
• .NET Framework 4.8

1. Download the latest EXE file from Releases.

This is a portable application. You can save it, run it, and then delete it when you're done. It won't leave any files or registry values behind.

Both your public certificate and private key are required for servers like Remote Desktop Services. These must be imported into a Windows certificate store using PKCS #12 format, which uses the P12 and PFX file extensions. If you don't convert to PKCS #12, the private key can't be imported, and you won't be able to encrypt traffic on your server.

If you have a certificate that you want to import, like a pair of PEM or DER files, you will first need to temporarily convert it to PKCS #12 using OpenSSL.

openssl pkcs12 -in "mypubliccert.pem.crt" -inkey "myprivatekey.pem.key" -out "mycertandkey.pfx" -export

After importing the PFX file, you can delete it from disk.

1. Run RemoteDesktopServicesCertificateSelector.exe.
2. If you haven't already done so, install your new certificate into Certificates (Local Computer) › Personal › Certificates.
   • You can open this certificate store by clicking Manage Local Computer Certificates.
   • Import the certificate using Action › All Tasks › Import…
   • On the Certificate Store page of the Certificate Import Wizard, ensure the Certificate Store choice set to Place all certificates in the following store: Personal.
   • Once it's installed, click Refresh in this program to show the newly-installed certificate.
3. Click the radio button for the certificate you want to use on your RDP connections.
4. Click Apply.

New RDP connections to your server will now use the new certificate. This change takes effect immediately for all new connections — you don't need to restart any services or your computer. Existing RDP sessions will continue to use the old certificate until you disconnect.

You can view a certificate or copy its SHA-1 thumbprint by right-clicking on a row.

To test the new certificate, you can reconnect using mstsc.exe. Next, click the 🔒 Security Information button in the fullscreen toolbar, then click View Certificate.

• If the Remote Desktop Connection is not in fullscreen, you can change Options › Display › Full Screen before connecting, or right-click the title bar and choose Full Screen after connecting.
• If the 🔒 button doesn't appear in the blue toolbar at the top of the screen when Remote Desktop Connection is in fullscreen, then the connection is using a self-signed certificate.

You can also test the certificate with OpenSSL.

openssl s_client -connect myserver.com:3389 | openssl x509 -noout -text