Change the RDP Certificate on Windows Server

A standalone Remote Desktop listener selects its certificate from the Local Computer Personal store by SHA-1 thumbprint. This is different from the role certificates of a full Remote Desktop Services deployment, which are assigned through the RD Connection Broker - for those, see the Remote Desktop Services guide.

Before you beginCopy Anchor Link

• Keep a second way in (console or another remote access path) in case the listener is misconfigured.
• Get a PFX with a private key, the Server Authentication EKU, and the server's FQDN in the SAN.
• Record the current thumbprint (see step 2) so you can switch back.
• Check whether Group Policy manages the listener certificate - Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > Server authentication certificate template. A policy-enforced certificate overwrites a local setting.
• Use Windows PowerShell 5.1 (powershell.exe) for the commands below. The *-WmiObject cmdlets do not exist in PowerShell 7 (pwsh).

Step-by-step certificate replacementCopy Anchor Link

1. Import the PFX into Certificates (Local Computer) > Personal. The listener runs under NETWORK SERVICE, so give that account Read on the private key: certlm.msc > right-click the certificate > All Tasks > Manage Private Keys > Add NETWORK SERVICE > Read.

2. Show the current value, then set the new thumbprint:

   Copy Text

   $ts = Get-WmiObject -Class Win32_TSGeneralSetting `
     -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'"
   $ts.SSLCertificateSHA1Hash                       # current thumbprint
   
   $thumbprint = "<new-certificate-thumbprint>" -replace '[^0-9A-Fa-f]',''
   $ts | Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash=$thumbprint}

   The -replace removes spaces and the invisible character that the certificate dialog adds when you copy a thumbprint - a common cause of "Invalid Parameter". That error also appears if the certificate is not in the computer's Personal store.

3. Read the value back and compare it with the certificate:

   Copy Text

   (Get-WmiObject -Class Win32_TSGeneralSetting -Namespace root\cimv2\terminalservices `
     -Filter "TerminalName='RDP-tcp'").SSLCertificateSHA1Hash
   Get-Item "Cert:\LocalMachine\My\$thumbprint" | Format-List Subject,NotAfter,HasPrivateKey

New connections use the new certificate; existing sessions keep running and are not a reliable test. No restart is normally needed - if new connections still show the old certificate, restart the Remote Desktop Services service (TermService), which ends the sessions on that server.

Alternative: the registryCopy Anchor Link

Microsoft also documents setting the thumbprint as a binary registry value: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, value SSLCertificateSHA1Hash (REG_BINARY) containing the thumbprint bytes. The NETWORK SERVICE permission from step 1 is needed here too. The WMI method above is simpler and easier to check.

Product-specific considerationsCopy Anchor Link

This page is for servers whose RDP listener you manage individually - a standalone server, or a session host's own listener. The certificates users see in an RDS farm (Gateway, Web Access, Connection Broker redirection) are set in the Remote Desktop Services guide. Older guides use wmic for the same change; wmic is deprecated on current Windows versions, so use PowerShell.

Verify the new certificateCopy Anchor Link

Open a new connection with mstsc.exe using the FQDN in the SAN. Click the padlock in the connection bar at the top of the full-screen session > View certificate > Details, and compare Thumbprint with the value you set. Test from a client that trusts the full chain; there should be no certificate warning.

RollbackCopy Anchor Link

Set SSLCertificateSHA1Hash back to the old thumbprint with the same command. Keep the old certificate and key until several new connections have succeeded.

If the server used its self-signed certificate before, that certificate is in the Remote Desktop store of the computer; set its thumbprint to go back:

Get-ChildItem 'Cert:\LocalMachine\Remote Desktop' | Format-Table Thumbprint,Subject,NotAfter

Common problemsCopy Anchor Link

• The certificate is in the Current User store or has no private key.
• An invisible character was copied into the thumbprint.
• NETWORK SERVICE cannot read the private key.
• The client connects by IP address while the certificate only contains a DNS name.
• A Group Policy setting replaces the local listener setting.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert RDP / RDS listener target imports the certificate and updates the local listener's WMI thumbprint. It is for a standalone listener, not the role certificates of a complete RDS deployment.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Microsoft Learn: Remote Desktop listener certificate configurations
• Microsoft Learn: Win32_TSGeneralSetting