Forum Discussion
DaytonG_131489
Nimbostratus
NimbostratusAPM - User Defined RDP in version 13 - digital signature issue
I'm testing out v13 and User Defined RDP via webtop in my lab and am getting the following message when launching the .RDP file:
"The digital signature of this RDP File cannot be verified. The remote connection cannot be started."
Has anyone run into this at all? I'm wondering if it could be related to the use of default "clientssl" and "serverssl" profiles for the Virtual Server associated with the Access Policy.
mr_shaggy_17493Hi All,
I'm a bit confuse here. After making creating cert like Chris Zhang mention above, the where should we used it? Client ssl profile? Client PC (whom accessing through F5)? Or on the RDP server?
Thanks anyway..
Client SSL profile.
You can recreate your cert as below.
root@u1:~ openssl x509 -req -days 3650 -in vpn.home.lab.csr -CA dc7.h.l.cer -CAkey dc7.h.l.key -out vpn.home.lab.cer -set_serial 129 -sha256 -extensions some_ext -extfile ssl_ext root@u1:~ cat ssl_ext [some_ext] extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment
paulooliveiraAltostratus
Hi,
When running the above command, I get the error below:
error loading the config file 'ssl_ext'
The command I'm running is:
openssl x509 -req -days 3650 -in /shared/tmp/client1.req -CA /shared/tmp/client1.crt -CAkey /shared/tmp/client1.key -out /shared/tmp/apm.labf5.com.br.crt -set_serial 129 -sha256 -extensions some_ext -extfile ssl_ext
Its correct?
- Matt_Dierick
Employee
The fact is the Microsoft RDP client has requirements about the certificates used to sign the .rdp files.
- self-signed certificates are forbidden,
- some extensions are needed, when creating the certificates.
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
Change the certificate on APM and RDS server with these requirements.
Danielle_Alper1Hey, is a self singed certificate should be enough ? im running the same test as DaytonG , ActiveX is not working with chrome browser and native option gives the same error as he mentioned "The digital signature of this RDP File cannot be verified. The remote connection cannot be started."
You assumptions is correct. You would need a valid client SSL certificate because the vdi profile generates a cryptographic signature based on the attached client SSL profile.
