Import certificates for Windows and Linux Gateways

A workflow for Privileged Remote Access

A certificate prompt before every RDP session allows users to approve connections without reading them, which makes it easier for an attacker to impersonate a system they trust. Trusting the right certificate removes the prompt and keeps the identity check meaningful.

Scope of this guide

This workflow shows you how to remove RDP certificate prompts in Privileged Remote Access (PRA). It covers integrated RDP sessions and Bring Your Own Tool (BYOT) RDP sessions separately, because a different computer serves the certificate in each case. The computer that receives the certificate is the one that must trust it.

For integrated RDP, the endpoint serves its certificate to the Gateway. The Gateway validates that certificate against the certificate store on its own computer: the Windows certificate store on a Windows Gateway , or the system trust store on a Linux Gateway as of version 26.2. If your endpoint certificates come from an internal certificate authority (CA), importing your Root CA certificate into that store removes the prompt for every endpoint at once. If your endpoints still use the self-signed certificates that Windows creates by default, you instead trust each endpoint certificate separately, or you turn on the Ignore Untrusted Certificate option on the Asset.

For BYOT RDP, the Gateway serves the certificate to the representative's own RDP client. The certificate it serves is custom_server.crt, with its private key custom_server.key, both in the Gateway installation directory. Either every representative computer adds that certificate to its trusted certificate store, or you replace those two files with a certificate the representative computers already trust.

Prerequisites

• You have administrative rights on the Gateway computer.
• You have an account with permission to edit Asset in the PRA administrative interface.
• A Gateway is installed and can reach the target endpoints.
• You have a copy of your Root CA certificate, if your endpoint certificates come from an internal CA.
• You have administrative rights on the target endpoints, if you plan to export their certificates.
• You have administrative rights on the representative computers, if you plan to trust a certificate there.
• BYOT is turned on under External Tools, if using BYOT RDP.

Steps

Complete one of Step 1, Step 2, or Step 3 for integrated RDP. Complete Step 4 or Step 5 for BYOT RDP.

Integrated RDP

Step 1: Import your Root CA certificate on the Gateway computer

Use this step when an internal CA issues your endpoint certificates. It removes the prompt for every endpoint that CA has issued to, so you do not repeat any work per endpoint.

1. Obtain your Root CA certificate from your internal CA. Obtain the public certificate only.
2. Copy the certificate file to the Gateway computer.
3. Import the certificate on the Gateway computer:
   • On a Windows Gateway, import it into the local computer Trusted Root Certification Authorities store. Import it under the computer account, not your user account.
   • On a Linux Gateway running version 26.2 or later, add it to the system trust store.
4. Start an integrated RDP session to one of the endpoints.

Step 2: Trust each endpoint certificate on the Gateway computer

Use this step when your endpoints still present self-signed certificates. Each self-signed certificate is unique, so repeat this step for every endpoint you reach with integrated RDP.

1. Export the certificate that the endpoint presents for RDP. Export the public certificate only, and do not export the private key. For the certificate location and the export process, refer to Microsoft's documentation.
2. Copy the exported certificate file to the Gateway computer.
3. Import the certificate into the certificate store on the Gateway computer, as described in Step 1.
4. Repeat this step for the next endpoint.

Step 3: Ignore the certificate on the Asset

Use this step when you cannot trust the endpoint certificate. This option removes the prompt without checking the certificate, so treat it as a temporary measure.

1. Sign in to the PRA Access Console.
2. Select the Assets tab.
3. Select the Remote RDP Asset you want to change, then select Edit.
4. Select Ignore Untrusted Certificate.
5. Select Save.
6. Repeat this step for each Remote RDP Asset that shows the prompt.

BYOT RDP

Step 4: Trust the Gateway certificate on each representative computer

Use this step for a small number of representative computers.

1. Open the Gateway installation directory on the Gateway computer and locate custom_server.crt.
2. Copy custom_server.crt to a location your representatives can reach. Do not distribute custom_server.key. This is the private key, and stays on the Gateway computer.
3. Import custom_server.crt into the Trusted Root Certification Authorities store on the representative computer.
4. Repeat this step on every representative computer that starts BYOT RDP sessions.

Step 5: Replace the Gateway certificate

Use this step when your representative computer already trust an internal CA. It scales as you add representatives, because new computers trust the certificate without any local change.

1. Obtain a certificate and matching private key from an authority the representative computers already trust. Request the files in PEM format.

   ℹ️

   The certificate must have localhost / 127.0.0.1 SANs.

2. Back up the existing server.crt and server.key files on the Gateway computer.
3. Copy the new certificate and key into the Gateway installation directory. Name them server.crt and server.key, and keep those exact file names.
4. Restart the Gateway so it serves the new certificate.

Verify the results

Verify that an integrated RDP session starts from the representative console with no certificate prompt. Confirm that a BYOT RDP session starts with no certificate warning in the representative's own RDP client, and that the certificate it presents is the one you trusted or installed.

Next steps

• Track the expiry date of every certificate you trusted or installed. The prompt returns when a certificate expires.
• Review which Assets use Ignore Untrusted Certificate, and plan to move them to a trusted certificate.

Related resources

• Assets | PRA for Web
• Assets | PRA On-prem
• Gateway guide | PRA