Replace RDS Certificates with Set-RDCertificate

A Remote Desktop Services deployment assigns certificates by role through the RD Connection Broker, which distributes them to the servers of each role:

One certificate whose SAN covers all the names users and clients use can serve all four roles, or you can use separate certificates per role. The Session Host's own RDP listener is a separate local setting - see Remote Desktop (RDP).

Before you beginCopy Anchor Link

• Obtain a password-protected PFX with a private key, Server Authentication EKU, and SANs for the external Gateway/Web names and internal broker names as applicable.
• Run from a host with the RemoteDesktop PowerShell module and administrative access to the deployment. Record Get-RDCertificate and export each old PFX securely.
• Keep the PFX files of the current certificates: rolling back means assigning them again, and a certificate whose key is not exportable cannot be exported later.
• Plan a maintenance window. Set-RDCertificate updates all servers of a role at once; connections that are being set up during the change can fail, and Gateway users may have to reconnect.

Step-by-step certificate replacementCopy Anchor Link

1. Inspect the deployment:

   Copy Text

   Import-Module RemoteDesktop
   $broker = "rdcb.example.com"
   Get-RDCertificate -ConnectionBroker $broker

2. Assign the PFX to each applicable role:

   Copy Text

   $password = Read-Host "PFX password" -AsSecureString
   $roles = "RDGateway","RDWebAccess","RDRedirector","RDPublishing"
   foreach ($role in $roles) {
     Set-RDCertificate -Role $role -ImportPath C:\secure\rds.pfx `
       -Password $password -ConnectionBroker $broker -Force
   }

   This assigns one certificate to all four roles. To use different certificates, run Set-RDCertificate per role with the matching PFX. Server Manager provides the same operation at Remote Desktop Services > Overview > Tasks > Edit Deployment Properties > Certificates and distributes a selected certificate to the servers for that role.

3. Read every role back with Get-RDCertificate. If Session Hosts also need a trusted RDP listener certificate, apply the standalone listener procedure to each host.

Product-specific considerationsCopy Anchor Link

Do not invent an RDLicensing value for Set-RDCertificate; Microsoft currently documents only the four roles above. Highly available Connection Brokers, Gateway farms, and Web Access farms must all be tested by node and through the load-balanced name. The cmdlet/import handles role distribution, so manually importing only on the broker is not equivalent.

Verify the new certificateCopy Anchor Link

Run Get-RDCertificate -ConnectionBroker $broker - each role must show the new thumbprint and expiry date and the level Trusted. Then check each Gateway and Web Access server directly and through the public name:

openssl s_client -connect rdgw.example.com:443 -servername rdgw.example.com -showcerts </dev/null

Launch a RemoteApp: the publisher shown in the security prompt is the RDPublishing certificate. Test external and internal DNS paths.

RollbackCopy Anchor Link

Run Set-RDCertificate again with the old PFX for each role you changed. Keep the old PFX files until Gateway access, Web Access, redirection and publishing tests pass; rolling back only helps while the old certificate is still valid.

Common problemsCopy Anchor Link

• The external load-balanced name is absent from SANs.
• Only one role was updated, leaving Gateway or publishing on the old certificate.
• The command targeted the wrong Connection Broker.
• A Session Host listener is confused with an RDS deployment role.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert RDS deployment target calls Set-RDCertificate for a selected role and Connection Broker. Use separate target assignments for each supported RDS role that needs the certificate.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Microsoft Learn: use certificates in Remote Desktop Services
• Microsoft Learn: Set-RDCertificate
• Microsoft Learn: Get-RDCertificate