Remote Desktop Services error message when new cert applied

[Nblakey96]

Evening all,

I've spend the day applying the new SSL wildcard to the servers, it has worked fine on the WAP and AD FS server however it is not allowing users to open up a connection. If I go to the RDS portal I can see the new cert, however after authenticating credentials and attempting to to open the session I get the error message "Your session ended because an unexpected server authentication certificate was received from the remote PC. Ask your admin or tech support for help."Has anyone had this in the past? If so how did you resolve it? I applied the cert using server manager and I can see the cert listed in IIS.Much appreciated

[CrootUK]

Is this using RDP or HTML5 webclient?

[Nblakey96]

It is using the HTML5 web client, I am able to sign in successfully using the back door method Edited December 23, 2021 by Nblakey96

[Oaktech]

Clear your browser cache.

[Jonah]

You may need to export the certificate from the MMC snap-in as a .cer file then run Import-RDWebClientBrokerCert “path to .cer”

[CrootUK]

Clear your browser cache.

 

2nd this

[fiza]

Did you get this resolved? Facing same issue here

[fiza]

I have cleared the browser cache, also done "Clear SSL State" in Internet Options but no joy.

[Nblakey96]

Yeah I managed to get this resolved eventually, I was only facing the issues on the HTML 5 version. Is yours working on the non-HTML5 version?

Here are the steps that I followed:

Get-RDWebClientBrokerCert

Shows the OLD certificate thumbprint, running this command (replacing the certificate with the exported BASE64 from MMC/Certificate)

Import-RDWebClientBrokerCert C:\temp\mycert.cer

And then just running this command for good measure

Publish-RDWebClientPackage -Type Production -Latest

and clearing every browser cache. The HTML5 client began to work.

 

- - - Updated - - -

 

Another thing I did notice too was that it did not begin to work until the old cert had expired. Once I had deleted the old cert it then worked.

[Gio_W]

Cheers, you're a lifesaver. Those PowerShell commands solved it for me as well.

I however did NOT have to delete the old cert.

Take care,

Giovanni

[migmjt]

This worked for me. I used the Powershell commands then an incognito browser window to test.

[Ruklaw]

Just in case anyone comes back to this in future, I think I have a long term fix for clients getting the certificate error when our RDWeb server renews it's certificate - we'll find out in 3 months....

 

To aid anyone googling, the error our users see on the current version of the HTML5 remote desktop site is:

 

Your session ended because an unexpected server authentication certificate was received from the remote PC. Ask your admin or tech support for help.

 

The problem is that the brokercert.cer gets cached by web browsers, so regular users of the remote system see this error when a new certificate goes on - they either need to delete cached files on their web browser or ctrl-f5 to force a reload of this file.

The solution is that we can use IIS headers to tell the web browser not to cache this file.

 

Open IIS Manager, then on your RDWeb site expand the path RDWeb\webclient\config

 

Double click the button on the right 'HTTP Response Headers"

 

Click 'Set Common Headers...' at the top right, then tick 'Expire Web Content' - Immediately, and OK

 

Click OK - you can now close IIS Manager.

 

It's worth making a note of this procedure as it's not clear if these settings will remain in place when you update the RDWeb site.

 

 

A shout out to Nirsoft ChromeCacheView which was very handy diagnosing and testing this solution, and these guys that have tried to get Microsoft to fix it (and been completely ignored of course) - https://github.com/MicrosoftDocs/windowsserverdocs/issues/2525

[Martinwonder]

Thank you so much honestly you are a life saver. This was causing me so much distress, Im so glad this community exists and to be apart of it

[liamrobinson]

If changing the Response headers alone does not solve the issue, ensure you have updated the .CER file to the web client too.

 

Import-RDWebClientBrokerCert "C:\certs\certname.cer"

 

Secure Remote Desktop Services with Microsoft Entra Application Proxy - Tech Blog, News, How To's and More.