6.5.1 Remote Desktop Services
Choose the correct RDS template and cover every certificate location
CertKit has separate templates for a full Remote Desktop Services deployment, a stand-alone RD Gateway, and the HTML5 Remote Desktop web client. They are not interchangeable.
Choose the correct template
| Template | Run it on | Behavior |
|---|---|---|
| Remote Desktop Services (full deployment) | RD Connection Broker | Applies the certificate to RD Gateway, RD Web Access, RDRedirector, and RDPublishing through Set-RDCertificate. |
| Remote Desktop Gateway (standalone) | Stand-alone RD Gateway | Updates the Gateway SSL certificate and restarts TSGateway. Do not use it for a Gateway managed by a Connection Broker. |
| Remote Desktop Web Client (HTML5) | RD Web Access server hosting the web client | Imports the public certificate into the web client’s separate certificate store and republishes the production package. |
CertKit can auto-discover full RDS deployments. Use the full-deployment template when discovery does not identify the deployment or when you need to limit the roles being updated.
Full deployment requirements
- Run the agent or deployment on the RD Connection Broker.
- The Windows
RemoteDesktopmodule must be available. - The certificate’s private key must be exportable because the broker distributes it to the role servers.
- The default role list covers
RDGateway,RDWebAccess,RDRedirector, andRDPublishing. Remove a role only when it is managed separately.
HTML5 web client requirement
The HTML5 web client keeps its own copy of the Connection Broker certificate. Set-RDCertificate does not update it. If the deployment uses the HTML5 client, configure both the full-deployment template and the Remote Desktop Web Client (HTML5) template.
The HTML5 template requires the RDWebClientManagement module on the RD Web Access server. It exports only the certificate’s public half, calls Import-RDWebClientBrokerCert, republishes the production package, and removes the temporary file.
If users receive “an unexpected server authentication certificate was received” after a renewal, confirm that the HTML5 template ran successfully and that it targeted the server hosting the web client.
Service interruption
The stand-alone RD Gateway template restarts TSGateway. Use a deployment window when a short interruption is not acceptable.
For a product overview, see certificate automation for Remote Desktop Services.