How to change Certificate on Remote Desktop Services

A Remote Desktop Services deployment assigns certificates by role through the RD Connection Broker. The supported certificate roles are RDGateway, RDWebAccess, RDRedirector, and RDPublishing; the Session Host's own RDP listener is a separate local setting.

Before you begin

• Obtain a password-protected PFX with a private key, Server Authentication EKU, and SANs for the external Gateway/Web names and internal broker names as applicable.
• Run from a host with the RemoteDesktop PowerShell module and administrative access to the deployment. Record Get-RDCertificate and export each old PFX securely.
• Drain highly available Gateway or Web nodes one at a time.

Step-by-step certificate replacement

1. Inspect the deployment:

   Import-Module RemoteDesktop
   $broker = "rdcb.example.com"
   Get-RDCertificate -ConnectionBroker $broker

2. Assign the PFX to each applicable role:

   $password = Read-Host "PFX password" -AsSecureString
   $roles = "RDGateway","RDWebAccess","RDRedirector","RDPublishing"
   foreach ($role in $roles) {
     Set-RDCertificate -Role $role -ImportPath C:\secure\rds.pfx `
       -Password $password -ConnectionBroker $broker -Force
   }

   Use separate PFX files where role names differ. Server Manager provides the same operation at Remote Desktop Services > Overview > Tasks > Edit Deployment Properties > Certificates and distributes a selected certificate to the servers for that role.

3. Read every role back with Get-RDCertificate. If Session Hosts also need a trusted RDP listener certificate, apply the standalone listener procedure to each host.

Product-specific considerations

Do not invent an RDLicensing value for Set-RDCertificate; Microsoft currently documents only the four roles above. Highly available Connection Brokers, Gateway farms, and Web Access farms must all be tested by node and through the load-balanced name. The cmdlet/import handles role distribution, so manually importing only on the broker is not equivalent.

Verify the new certificate

Run Get-RDCertificate -ConnectionBroker $broker, connect to RD Web and RD Gateway, launch a RemoteApp, and inspect the TLS certificate and signed .rdp file as relevant. Test external and internal DNS paths.

Rollback

Re-run Set-RDCertificate with the old role-specific PFX. Keep all old private keys until Gateway access, Web Access, redirection, and publishing tests pass.

Common problems

• The external load-balanced name is absent from SANs.
• Only one role was updated, leaving Gateway or publishing on the old certificate.
• The command targeted the wrong Connection Broker.
• A Session Host listener is confused with an RDS deployment role.

Automating certificate replacement with aethercert

The aethercert RDS deployment target calls Set-RDCertificate for a selected role and Connection Broker. Use separate target assignments for each supported RDS role that needs the certificate.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

Sources

• Microsoft Learn: use certificates in Remote Desktop Services
• Microsoft Learn: Set-RDCertificate
• Microsoft Learn: Get-RDCertificate