Lets Encrypt Cert for 2012r2 RDS Gateway

[Linfit]

I am running a 2012r2 RDS Gateway server for Remote Desktop and Web Access, all working fine but the wildcard cert I used has expired.

Not going to buy a new one as the domain name needs changing anyway, so trying to get a LetsEncrypt cert using the Certify the Web tool.

 

Have given the tool all the relevant info and it when I do a test request it passes the test, but an actual request fails, with the following error:

 

http://remote.xxxxxxxxxxx.uk/.well-known/acme-challenge/vqNKZE7iV6R9TFJqMybWHES5HSKGiP9bWQEZGrs9vks: Timeout during connect (likely firewall problem)

 

I can see the small challange file it places in the root of the website has been created, it just doesn't seem to be able to find it when it tries to verify the domain. I am not actually sure where this should go - it says in the website root - is this the default root for IIS, which would be in C:\inetpub\wwwroot, or in the root of the RDWeb site which is c:\windows\web\rdweb ?

 

Instructions for Certify the web say that ports 80 and 443 need to be open, which they are, otherwise our Web Access would not have been working, so not sure it is a firewall problem.

 

Any advice gratefully received. Should have sorted this sooner as I knew the cert expiry date, but too much other stuff going on.....

[Boredguy]

Your "remote" subdomain is setup in the public accessible DNS?

I found when trying to set it up on a backup server the other week, that unless the server IP and domain name were the same as the public record it gave a similar error.

When I tried to setup a certificate on our RDS Gateway, the LetsEncrypt one was not able to be selected within RDS, but was fine for the website.

[Linfit]

Yep, remote.xxxxx.uk resolves correctly to our RDWeb interface, DNS appears correct.

The public IP is NAT'ed through to the private IP of the server.

 

I did have to do some powershell commands to set the domain name used by RDS to match, as the FQDN of the server is not remote.xxxxx.uk - we have a .local internal domain.

Could this be the root cause ?

 

There must be a lot of similar setups with RDS using Lets Encrypt but google is failing me at the moment....

[Boredguy]

I used the tool from https://www.win-acme.com/ to generate our LetsEncrypt certificates on both our web host and tried it for our RDP gateway which has FQDN (which is set in IIS, local server name/domain does not matter)

[Boredguy]

@Linfit it actually turned out to be quite simple using the resources from the site I referenced earlier as it turns out there is Powershell scripts included for adding the certificate to RDS.

 

Create a batch file in the same folder as the wacs.exe file, and if you have a all in 1 instance with IIS, RD Gateway, Broker etc, you can call the following, or just change it to be the PS file that you want

 

wacs.exe --target iis --siteid 1 --certificatestore My --installation iis,script --script "Scripts\ImportRDSFull.ps1" --scriptparameters "{CertThumbprint}"

[Linfit]

@Boredguy - thank you.

 

Used the win-acme tools you pointed me at and it verfied and produced the cert straight away,then just had to assign the new cert in Gateway Manager and everything works fine.

I will look into the scripts for RDS to automate the process jsut in case I don't get the new setup sorted before the current cert expires as don't want that last manual step.