How to ignore the certificate warning on remote desktop connection

ssl windows-server-2008 remote-desktop registrykey
Stoimen picture Stoimen · Dec 19, 2013 · Viewed 37.6k times · Source

I am trying to ignore the certificate warning on remote desktop connection - the one in the image:

enter image description here

So far I have found that when I check the "don't ask again" checkbox it is generating registry key over here:

HKCU:\Software\Microsoft\Terminal Server Client\Servers

A new record is generated with the name of the server and key name CertHash that contains a value that is specific for a machine. The key is the same for a machine - if I delete it and check the checkbox the same value is again generated. There is a new value in case I recreate the virtual machine so I think it is something machine specific.

Can someone tell me how is this hash generated so I can populate the key from command line? Adding certificate is not an option and the machines will be frequently regenerated so I need an option to ignore this automatically as I need to connect a user to the machine and run some programs in it.

Answer

gbabu picture gbabu · May 1, 2015

I know this is an old question. But this may help someone who is looking for the same solution.

Method 1

You may over ride the certificate check for ALL RDP connections (use it at your own risk)

Just add a new registry key as below.

reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client" /v "AuthenticationLevelOverride" /t "REG_DWORD" /d 0 /f

Method 2

Considering if you have admin rights on the remote machine, you could actually get the crethash value from the remote machine using the below wmic command. So you could make a small batch file to get this value before you launch the mstsc and add this value in registry. I haven't included the complete batch file but thats the idea. 

wmic /node:Testserver /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSGeneralSetting get SSLCertificateSHA1Hash

Related questions

The client and server cannot communicate, because they do not possess a common algorithm on Windows Server 2008 Web

I am working on a ASP.Net WebForms application. We are using PayFort's Start API for the payment process. The application is running fine on our local machine (Windows 10) but it shows following error when we try to make payment …

Read More
How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More