How to change Certificate on Remote Desktop Protocol

Learn how to manually replace the TLS certificate on a standalone Windows RDP listener, update its WMI thumbprint, and verify new connections.

A standalone Remote Desktop listener selects a certificate from the Local Computer Personal store by SHA-1 thumbprint. This is different from the certificates assigned to a full Remote Desktop Services deployment through the RD Connection Broker.

Before you begin

Keep a second administrative access path in case the listener is misconfigured.
Obtain a PFX whose SAN contains the server FQDN, with Server Authentication EKU and a private key. Record the old SSLCertificateSHA1Hash.
Confirm whether Group Policy manages the listener. A policy-enforced certificate can overwrite a local setting.

Understand the RDP listener

The RDP-Tcp listener reads SSLCertificateSHA1Hash from the Win32_TSGeneralSetting WMI class in root\cimv2\TerminalServices. Network Service must be able to read the private key. Updating the hash changes the certificate for new RDP connections; existing sessions are not a reliable verification path.

Step-by-step certificate replacement

Import the PFX into Cert:\LocalMachine\My and grant NETWORK SERVICE Read on the private key through certlm.msc > Manage Private Keys.

Record the existing value, then set the replacement:

$thumbprint = "<new-certificate-thumbprint>" -replace '\s',''
$setting = Get-WmiObject -Class Win32_TSGeneralSetting `
  -Namespace root\cimv2\terminalservices `
  -Filter "TerminalName='RDP-tcp'"
$setting | Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash=$thumbprint}

Read the WMI property back and compare it to Get-Item Cert:\LocalMachine\My\$thumbprint. A service or server restart is not normally required; test a completely new RDP connection.

Product-specific considerations

For a farm with Connection Broker, Gateway, or Web Access, also follow the Remote Desktop Services guide. Each Session Host listener is local, so update every host unless Group Policy deploys and selects its certificate.

Verify the new certificate

Connect with mstsc.exe using the FQDN in the SAN, open the connection certificate, and compare its thumbprint. Test from a client that trusts the full chain and has no resumed session.

Rollback

Set SSLCertificateSHA1Hash back to the old thumbprint using the same WMI command. Keep the old certificate and key until several new connections succeed.

Common problems

Certificate imported under Current User or without a private key.
Invisible whitespace copied into the thumbprint.
Network Service lacks private-key access.
Client connects by IP while the certificate contains only a DNS SAN.
A domain policy replaces the local listener setting.

Automating certificate replacement with aethercert

The aethercert RDP / RDS listener target imports the certificate and updates the local listener's WMI thumbprint. It is for a standalone listener, not the role certificates of a complete RDS deployment.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.