{"id":15779577,"url":"https://github.com/aldaviva/remotedesktopservicescertificateselector","last_synced_at":"2025-05-12T20:54:59.361Z","repository":{"id":70211987,"uuid":"258221864","full_name":"Aldaviva/RemoteDesktopServicesCertificateSelector","owner":"Aldaviva","description":"🔒 Choose a different certificate to use for your Windows Remote Desktop server.","archived":false,"fork":false,"pushed_at":"2024-08-28T03:05:54.000Z","size":204,"stargazers_count":10,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-05-06T19:09:32.613Z","etag":null,"topics":["certificate","rdc","rdp","rds","remote-desktop","remote-desktop-protocol","remote-desktop-services","terminal-services"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Aldaviva.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":"License.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":["https://paypal.me/aldaviva"]}},"created_at":"2020-04-23T13:53:18.000Z","updated_at":"2024-11-25T17:01:57.000Z","dependencies_parsed_at":"2024-10-04T18:20:40.369Z","dependency_job_id":"741d9189-8309-4dd5-8620-9f2fe1fc3765","html_url":"https://github.com/Aldaviva/RemoteDesktopServicesCertificateSelector","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Aldaviva%2FRemoteDesktopServicesCertificateSelector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Aldaviva%2FRemoteDesktopServicesCertificateSelector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Aldaviva%2FRemoteDesktopServicesCertificateSelector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Aldaviva%2FRemoteDesktopServicesCertificateSelector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Aldaviva","download_url":"https://codeload.github.com/Aldaviva/RemoteDesktopServicesCertificateSelector/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253822595,"owners_count":21969832,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate","rdc","rdp","rds","remote-desktop","remote-desktop-protocol","remote-desktop-services","terminal-services"],"created_at":"2024-10-04T18:20:32.661Z","updated_at":"2025-05-12T20:54:59.275Z","avatar_url":"https://github.com/Aldaviva.png","language":"C#","funding_links":["https://paypal.me/aldaviva"],"categories":[],"sub_categories":[],"readme":"\u003cimg src=\"https://raw.githubusercontent.com/Aldaviva/RemoteDesktopServicesCertificateSelector/master/RemoteDesktopServicesCertificateSelector/Resources/terminalServicesManagement.ico\" width=\"32\" valign=\"-5px\" alt=\"program icon\" /\u003e Remote Desktop Services Certificate Selector\n===\n\n[![build status](https://img.shields.io/github/actions/workflow/status/Aldaviva/RemoteDesktopServicesCertificateSelector/dotnetframework.yml?branch=master\u0026logo=github)](https://github.com/Aldaviva/RemoteDesktopServicesCertificateSelector/actions/workflows/dotnetframework.yml)\n\nThis GUI program lets you choose the certificate to encrypt your Remote Desktop Services connections.\n\nIn Windows Server 2008 R2 and earlier, this functionality was available in the Remote Desktop Session Host Configuration (`tsconfig.msc`). However, Microsoft deleted this file from Windows Server 2012 and later, which means you can only [configure it programmatically using WMI](https://serverfault.com/a/444287/227008). This program restores the graphical certificate choice functionality that was removed.\n\nThanks to [major web browser vendors needlessly bullying certificate authorities into restricting the maximum validity period of certificates to roughly 1 year](https://www.ssls.com/blog/apples-new-ssl-lifetime-limitation-and-what-it-means-for-you/), I now have to deal with this problem far more often than if I could just buy a 5-year cert, install it once, and then not think about it for a long time. This change makes no sense: my owner checks are simply using domain validation, which is just a simple proof of DNS control and does not guarantee much of anything; key rotation is not more frequent because you are not required to generate a new private key or certificate signing request, just a public cert; and all of the improvements over time in public key cryptography come from the protocols which use the certificates, not the certs themselves, such as Apache httpd and Nginx implementing HTTP/2, TLS 1.3, and improved cipher suites.\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/Aldaviva/RemoteDesktopServicesCertificateSelector/master/.github/images/screenshot-dark.png\" alt=\"program screenshot\" /\u003e\u003c/p\u003e\n\n\u003c!-- MarkdownTOC autolink=\"true\" bracket=\"round\" autoanchor=\"false\" levels=\"1,2,3\" style=\"ordered\" --\u003e\n\n1. [Requirements](#requirements)\n1. [Installation](#installation)\n1. [Certificate Conversion](#certificate-conversion)\n1. [Usage](#usage)\n1. [Validation](#validation)\n\n\u003c!-- /MarkdownTOC --\u003e\n\n## Requirements\n\n- Windows\n    - Tested on Server 2019\n    - Should work on any other versions too\n- [.NET Framework 4.8](https://dotnet.microsoft.com/download/dotnet-framework)\n\n## Installation\n\n1. Download the [latest EXE](https://github.com/Aldaviva/RemoteDesktopServicesCertificateSelector/releases/latest/download/RemoteDesktopServicesCertificateSelector.exe) file from [Releases](https://github.com/Aldaviva/RemoteDesktopServicesCertificateSelector/releases/latest).\n\nThis is a portable application. You can save it, run it, and then delete it when you're done. It won't leave any files or registry values behind.\n\n## Certificate Conversion\nBoth your public certificate and private key are required for servers like Remote Desktop Services. These must be imported into a Windows certificate store using [PKCS #12](https://wikipedia.org/wiki/PKCS_12) format, which uses the P12 and PFX file extensions. If you don't convert to PKCS #12, the private key can't be imported, and you won't be able to encrypt traffic on your server.\n\nIf you have a certificate that you want to import, like a pair of PEM or DER files, you will first need to temporarily convert it to PKCS #12 using [OpenSSL](https://wiki.overbyte.eu/wiki/index.php/ICS_Download#Download_OpenSSL_Binaries).\n\n```sh\nopenssl pkcs12 -in \"mypubliccert.pem.crt\" -inkey \"myprivatekey.pem.key\" -out \"mycertandkey.pfx\" -export\n```\n\n\u003e [!WARNING]\n\u003e This PFX file, *not* the CRT file, is the correct file to import into the Windows certificate store, because it includes the private key. Be aware that the Certificate Import Wizard defaults to only showing CER and CRT files, so it's easy to accidentally import without the private key and therefore be unable to use it with your server. Be sure to change the file type dropdown in the Open dialog box from \"X.509 Certificate\" to \"Personal Information Exchange\" so that your PFX file is shown.\n\nAfter importing the PFX file, you can delete it from disk.\n\n## Usage\n\n1. Run \u003cimg src=\"https://raw.githubusercontent.com/Aldaviva/RemoteDesktopServicesCertificateSelector/master/RemoteDesktopServicesCertificateSelector/Resources/terminalServicesManagement.ico\" height=\"16\" alt=\"program icon\" valign=\"-2px\" /\u003e `RemoteDesktopServicesCertificateSelector.exe`.\n1. If you haven't already done so, install your new certificate into Certificates (Local Computer) › Personal › Certificates.\n    - You can open this certificate store by clicking **![certs](https://raw.githubusercontent.com/Aldaviva/RemoteDesktopServicesCertificateSelector/master/RemoteDesktopServicesCertificateSelector/Resources/certs.ico?_=1) Manage Local Computer Certificates**.\n    - Import the certificate using Action › All Tasks › **Import…**\n    - On the Certificate Store page of the Certificate Import Wizard, ensure the Certificate Store choice set to Place all certificates in the following store: **Personal**.\n    - Once it's installed, click **![refresh](https://raw.githubusercontent.com/Aldaviva/RemoteDesktopServicesCertificateSelector/master/RemoteDesktopServicesCertificateSelector/Resources/refresh.png) Refresh** in this program to show the newly-installed certificate.\n1. Click the radio button for the certificate you want to use on your RDP connections.\n1. Click **![save](https://raw.githubusercontent.com/Aldaviva/RemoteDesktopServicesCertificateSelector/master/RemoteDesktopServicesCertificateSelector/Resources/save.ico) Apply**.\n\nNew RDP connections to your server will now use the new certificate. This change takes effect immediately for all new connections — you don't need to restart any services or your computer. Existing RDP sessions will continue to use the old certificate until you disconnect.\n\nYou can view a certificate or copy its SHA-1 thumbprint by right-clicking on a row.\n\n## Validation\n\nTo test the new certificate, you can reconnect using `mstsc.exe`. Next, click the 🔒 Security Information button in the fullscreen toolbar, then click View Certificate.\n\n- If the Remote Desktop Connection is not in fullscreen, you can change Options › Display › Full Screen before connecting, or right-click the title bar and choose Full Screen after connecting.\n- If the 🔒 button doesn't appear in the blue toolbar at the top of the screen when Remote Desktop Connection is in fullscreen, then the connection is using a self-signed certificate.\n\nYou can also test the certificate with [OpenSSL](https://wiki.overbyte.eu/wiki/index.php/ICS_Download#Download_OpenSSL_Binaries).\n```sh\nopenssl s_client -connect myserver.com:3389 | openssl x509 -noout -text\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faldaviva%2Fremotedesktopservicescertificateselector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faldaviva%2Fremotedesktopservicescertificateselector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faldaviva%2Fremotedesktopservicescertificateselector/lists"}