Sorry for the long writeup,
TLDR; How do I deploy a cert from a root ca that will be accepted by it's own RDS roll
I have recently been tasked to configure a server 2016 RDS for remote app deployment. I have successfully configured the remote app deployment. It's a lot of fun and works great!
The problem is with the certifications. I will need the login to be as seamless as possible (no logins or cert warnings) because it will be deployed to the shop floor. I am very new to AD CS and I have been vigorously googling as fast as possible to try and catch up to speed.
The RDS server is also the enterprise root ca for my .local domain. I figured I would put the ad cs roll on the same server that is deploying the remote app, since we are not big enough to warrant the best practice of having a standalone offline root ca. My plan is to have all of the certs applied internally, with autoenroll per computer. There is no need to have an external cert at this time.
Again, I'm very new so I'm probably doing something wrong, but I can't figure out what. Starting on the MMC window I have with 3 snap-ins;
Certificate Templates, which correctly points to my primary DC AD database.
Certificates (Local Computer)
Certification Authority
I click on the Certificate Templates snap-in that points to my primary DC's cert template db. I right click on the Computer template and duplicate.
Under the General tab, I give it the name - RDPAuth, and check the Publish certificate in AD box. I believe this gives me the ability to deploy via gpo later if I want?
Under the Request Handling tab, I check the Allow private key to be exported box. I believe this is needed to generate the .pfx cert required by the RD Web and RD connection broker later.
I check the extensions tab to make sure the the application policies contains both server and client auth.
Under the security tab, I check the boxes for read and autoenroll for domain computers. I think these will be needed later for auto deployment to the domain PCs.
All other tabs I leave alone.
Now that the template has been created, I click on Certificate Templates under the Certification Authority snap-in.
I right click the templates and do New > Certificate Template to issue, and select the RDPAuth cert I just created.
I then need to request a cert to be generated so that I can export the .pfx to be used by RDS, so I go to the Certificates (Local Computer) snap-in and All Tasks > Request New Certificate. I drill next through the wizard until I see our RDPAuth. I check it and Enroll. It then appears under personal certificates.
I right click on the newly created cert, and All Tasks > Export. I click Yes, export the private key, and leave the PIE boxes default. I choose Password for security. I then store the cert on a folder in C:\, and name it RDcert. I click next until export is successful.
I then switch over to the Server Manager tool, and click on the RDS tab. I click on Tasks under Deploment Overview, and click edit deployment properties. Under certificates, I select existing certificates and browse to the RDcert.pfx we just made. I enter the password, and check the allow cert to be published to the trusted root ca store. I can only do one roll service at a time, but each one acts the same. I gives a success tag under state, but level remains not configured, and status shows --
Any help or suggestions would be greatly appreciated.Thanks in advance.