This is because the certificate used by the RDP-Licenser is not a trusted certificate by a CA. It could be a self-signed certificate. To check the thumbprint of the cert which is being used for RDP session, follow this:
- Bring up Local Machine Certificate Store. CertLM.msc (Windows Server 2012) or use MMC and Add the Certificate Snapin.
- Go to "Remote Desktop" store and you should see the certificate there.
- Mark down the Thumbprint and check if it matches the thumbprint in the WMIC
- In an elevated command prompt, do a "Wbemtest"
- Connect to Namespace "root\cimv2\terminalservices"
- Click on "Enum Classes", select "Recursive" and click OK
- Scroll down to Win32_TSGeneralSettings and double click it.
- Click on the "Instances" button on the right
- Scroll down to "SSLCertificateSHA1Hash" and double click on it.
- You will be able to see the Thumbprint of the cert. See if that matches the one that you have marked down just now.
So, to use a trusted certificate by a CA. You will have to import a cert into the Personal Store and change the thumbprint of WMI instance.
- If you are using an SSL cert from 3rd party CA, make sure you import into the personal store with a private key. You will see a little pad lock on the icon of the cert.
- Once imported, find out what the thumbprint is for that cert.
- http://blogs.technet.com/b/askperf/archive/2014/05/28/listener-certificate-configurations-in-windows-server-2012-2012-r2.aspx
- Update the WMI with this
- wmic /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<<your_cert_thumbprint>>"
- If you get an error like this, most likely you cert does not have a private key.
- Check to make sure there is no other ASCII characters which are not suppose to be there.
- You will get an "Update Successful" message if everything goes well.
Hope this help...
