APM - User Defined RDP in version 13 - digital signature issue

You can recreate your cert as below.

root@u1:~ openssl x509 -req -days 3650 -in vpn.home.lab.csr -CA dc7.h.l.cer -CAkey dc7.h.l.key -out vpn.home.lab.cer -set_serial 129 -sha256 -extensions some_ext -extfile ssl_ext

root@u1:~ cat ssl_ext 
[some_ext]

extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

You assumptions is correct. You would need a valid client SSL certificate because the vdi profile generates a cryptographic signature based on the attached client SSL profile.

Hey, is a self singed certificate should be enough ? im running the same test as DaytonG , ActiveX is not working with chrome browser and native option gives the same error as he mentioned "The digital signature of this RDP File cannot be verified. The remote connection cannot be started."

The fact is the Microsoft RDP client has requirements about the certificates used to sign the .rdp files.

• self-signed certificates are forbidden,
• some extensions are needed, when creating the certificates.

extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection

basicConstraints = CA:FALSE

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

Change the certificate on APM and RDS server with these requirements.

Hi All,

I'm a bit confuse here. After making creating cert like Chris Zhang mention above, the where should we used it? Client ssl profile? Client PC (whom accessing through F5)? Or on the RDP server?

Thanks anyway..