Sign RDP files using your own certificate on the client side

To simplify the procedure, multiple powershell scripts have been written at your disposal. Please change the values of the variables with your own first before using them.

First step

You will need first to create your own signing certificate, with an exportable private key.

This requires admin privileges.

Note that the thumbprint of the certificate will be in the user configuration side.

$organization = "MyCompany"
$commonName = "RDP Signer"
$friendlyName = "RDP Signing Certificate"
$pfxPassword = "MyStrongPassword!"
$pfxFilePath = [Environment]::CurrentDirectory + "\signer.pfx"
# In years
$validityDuration = 3

Write-Host Certificate will be created in $pfxFilePath

# Generate the signing certificate
$cert = New-SelfSignedCertificate `
    -Type CodeSigningCert `
    -Subject "CN=$commonName, O=$organization" `
    -KeyUsage DigitalSignature `
    -KeyExportPolicy Exportable `
    -FriendlyName $friendlyName `
    -CertStoreLocation "Cert:\LocalMachine\My" `
    -NotAfter (Get-Date).AddYears($validityDuration)

# Generate the pfx file to import on client computer
$thumb = $cert.Thumbprint

Write-Host Certificate thumbprint: $thumb

$pwd = ConvertTo-SecureString -String $pfxPassword -Force -AsPlainText
Get-ChildItem -Path Cert:\LocalMachine\My\$thumb |
    Export-PfxCertificate -FilePath "$pfxFilePath" -Password $pwd

Second step (On the user workstation)

Once the signing certificate is generated, in order for your client to use it, they will need to do the following:

import the certificate in the “CurrentUser\My” store to be able to sign rdp files with rdpsign using the certificate thumbprint
import the certificate in the “CurrentUser\Root” store so that signed rdp with this certificate are recognized

$pfxFilePath = [Environment]::CurrentDirectory + "\signer.pfx"
$pfxPassword = "MyStrongPassword!"

$pwd = ConvertTo-SecureString -String $pfxPassword -Force -AsPlainText

# Import pfx in CurrentUser\My certificate store to be able to sign with rdpsign using the thumbprint
Import-PfxCertificate -FilePath "$pfxFilePath" -CertStoreLocation "Cert:\CurrentUser\My" -Password $pwd

# Import pfx to the trusted root certificate authority of the user, so that signed rdp with this certificate are recognized.
# Note: this triggers a windows confirmation popup
Import-PfxCertificate -FilePath "$pfxFilePath" -CertStoreLocation "Cert:\CurrentUser\Root" -Password $pwd

Third step (On the user workstation)

To make the computer fully trust the rdp file signed with this certificate, you will need to add it in the trusted certificate thumbprint list of the registry.
location: “HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services”
key: “TrustedCertThumbprints”
type: string

Note: since we write here in HKEY_LOCAL_MACHINE, admin privileges will be needed.

$thumbprint = "YOUR_THUMBPRINT"

$regPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services"
$keyName = "TrustedCertThumbprints"

$current = (Get-ItemProperty -Path $regPath -Name $keyName -ErrorAction SilentlyContinue).$keyName
$newValue = if ([string]::IsNullOrWhiteSpace($current)) { $thumbprint } else { "$current,$thumbprint" }

New-Item -Path $regPath -Force | Out-Null
New-ItemProperty -Path $regPath -Name $keyName -Value $newValue -PropertyType String -Force | Out-Null

Fourth step (on the user workstation)

Finally, to tell the “Connection Client” program to sign using your certificate and sign with its thumbprint, you will need to set the following registry key: location: “HKEY_CURRENT_USER\Software\Digital River\ConnectionClient”
OR
location: “HKEY_LOCAL_MACHINE\Software\Digital River\ConnectionClient”

key: “CertThumbprint”
type: string
value: YOUR_THUMBPRINT

$thumbprint = "YOUR_THUMBPRINT"
New-ItemProperty -Path "HKCU:\Software\Digital River\ConnectionClient" -Name "CertThumbprint" -PropertyType String -Value $thumbprint -Force