{"id":1351,"date":"2023-11-15T14:27:20","date_gmt":"2023-11-15T06:27:20","guid":{"rendered":"https:\/\/aichh.com\/?p=1351"},"modified":"2023-11-15T14:27:20","modified_gmt":"2023-11-15T06:27:20","slug":"%e7%94%9f%e6%88%90%e6%9b%b4%e9%95%bf%e6%9c%89%e6%95%88%e6%9c%9f%e7%9a%84-rdp-ssl-%e8%87%aa%e7%ad%be%e5%90%8d%e8%af%81%e4%b9%a6","status":"publish","type":"post","link":"https:\/\/aichh.com\/1351.html","title":{"rendered":"\u751f\u6210\u66f4\u957f\u6709\u6548\u671f\u7684 RDP SSL \u81ea\u7b7e\u540d\u8bc1\u4e66"},"content":{"rendered":"<!--wp-compress-html--><!--wp-compress-html no compression--><p>\u9ed8\u8ba4\u7684 RDP \u81ea\u7b7e\u540d\u8bc1\u4e66\u6709\u6548\u671f\u53ea\u6709\u534a\u5e74, \u5bf9\u4e8e\u6211\u6765\u8bf4\u592a\u77ed, \u4e00\u65e6\u8fc7\u671f, \u8fde\u63a5 rdp \u65f6\u63d0\u793a\u8bc1\u4e66\u4e0d\u53d7\u4fe1\u4efb\u7684\u8b66\u544a\u5c31\u5f88\u70e6\u607c, \u4fe1\u4efb\u6216\u4e0d\u4fe1\u4efb\u90fd\u9ebb\u70e6.<\/p>\n<p>\u53ef\u4ee5\u4f7f\u7528\u514d\u8d39\u6216\u6536\u8d39\u7684 SSL \u8bc1\u4e66, \u5e76\u914d\u7f6e\u81ea\u52a8\u66f4\u65b0\u8bc1\u4e66\u670d\u52a1. \u4f46\u8fd9\u6837\u8fd8\u662f\u6709\u4e0d\u4fbf\u7684\u5730\u65b9, \u6240\u4ee5\u6211\u9009\u62e9\u53e6\u4e00\u79cd\u65b9\u5f0f: \u751f\u6210\u66f4\u957f\u6709\u6548\u671f\u7684\u81ea\u7b7e\u540d SSL \u8bc1\u4e66, \u4f46\u6ce8\u610f: \u66f4\u957f\u6709\u6548\u671f\u7684 SSL \u8bc1\u4e66\u53ef\u80fd\u589e\u52a0\u5b89\u5168\u98ce\u9669.<\/p>\n<p>\u4e3a\u4f55\u4e0d\u81ea\u5efa CA ? \u56e0\u4e3a\u62c5\u5fc3\u7ba1\u7406\u4e0d\u5584, \u5bfc\u81f4\u81ea\u5efa CA \u6210\u4e3a\u5176\u4ed6\u8ba1\u7b97\u673a\u7684\u5b89\u5168\u98ce\u9669\u6765\u6e90.<\/p>\n<h2 id=\"\u4f7f\u7528-powershell-\u4e24\u884c\u4ee3\u7801\u641e\u5b9a\">\u4f7f\u7528 powershell, \u4e24\u884c\u4ee3\u7801\u641e\u5b9a<\/h2>\n<div class=\"highlight\">\n<pre tabindex=\"0\"><code class=\"language-powershell\" data-lang=\"powershell\">$newcert = New-SelfSignedCertificate -Subject \"CN=$([System.Net.Dns]::GetHostName())\" -KeyLength 4096 -NotAfter $([datetime]::Now.AddYears(5)) -KeyExportPolicy NonExportable -TextExtension @(\"2.5.29.37={text}1.3.6.1.5.5.7.3.1\", \"2.5.29.19={critical}{text}ca=0\") -Type SSLServerAuthentication -CertStoreLocation Cert:LocalMachineMy\r\n\r\nSet-CimInstance -Namespace 'rootcimv2TerminalServices' -Query 'SELECT * FROM Win32_TSGeneralSetting WHERE TerminalName = \"RDP-Tcp\"'  -Property @{ SSLCertificateSHA1Hash = $newcert.Thumbprint }\r\n<\/code><\/pre>\n<\/div>\n<p>\u73b0\u5728, \u91cd\u542f\u8ba1\u7b97\u673a\u6216\u8005\u91cd\u542f \u201cRemote Desktop Services\u201d \u670d\u52a1\u5373\u53ef\u4f7f\u7528\u65b0\u8bc1\u4e66\u8fde\u63a5\u3002<\/p>\n<p>\u9a8c\u8bc1\uff1a<\/p>\n<div class=\"highlight\">\n<pre tabindex=\"0\"><code class=\"language-powershell\" data-lang=\"powershell\"># \u67e5\u770b\u65b0\u8bc1\u4e66\u7684\u6307\u7eb9\r\nls Cert:LocalMachineMy\r\n# \u67e5\u770b\u6307\u5b9a\u7684 SSL \u8bc1\u4e66\u6307\u7eb9\r\nGet-CimInstance -Namespace 'rootcimv2TerminalServices' -Query 'SELECT * FROM Win32_TSGeneralSetting WHERE TerminalName = \"RDP-Tcp\"'\r\n<\/code><\/pre>\n<\/div>\n<h3 id=\"\u53c2\u6570\u89e3\u91ca\">\u53c2\u6570\u89e3\u91ca<\/h3>\n<p>\u7b2c\u4e00\u6761 powershell \u547d\u4ee4\u751f\u6210\u4e00\u4e2a\u81ea\u7b7e\u540d\u8bc1\u4e66:<\/p>\n<ul>\n<li>CN=\u8ba1\u7b97\u673a hostname (Subject)<\/li>\n<li>\u6709\u6548\u671f\u4e94\u5e74 (NotAfter)<\/li>\n<li>\u65b0\u8bc1\u4e66\u4e0d\u53ef\u5bfc\u51fa\u79c1\u94a5 (KeyExportPolicy)<\/li>\n<li>\u7533\u660e\u8bc1\u4e66\u7528\u9014\u4e3a \u201cServer Authentication\u201d (TextExtension, Type)<\/li>\n<li>\u8bc1\u4e66\u5b58\u653e\u5230 \u201c\u672c\u5730\u8ba1\u7b97\u673a\u4e2a\u4eba\u201d \u533a\u57df, \u533a\u522b\u4e8e \u201c\u7528\u6237\u4e2a\u4eba\u8bc1\u4e66\u201d \u533a\u57df (CertStoreLocation)<\/li>\n<\/ul>\n<p>\u7b2c\u4e8c\u6761\u547d\u4ee4\u8bbe\u7f6e RDP \u670d\u52a1\u4f7f\u7528\u7684\u8bc1\u4e66\u6307\u7eb9, \u8bbe\u7f6e\u4f1a\u5f71\u54cd\u6b64\u6ce8\u518c\u8868\u952e:<\/p>\n<div class=\"highlight\">\n<pre tabindex=\"0\"><code class=\"language-reg\" data-lang=\"reg\">[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlTerminal ServerWinStationsRDP-Tcp]\r\n\"SSLCertificateSHA1Hash\"\r\n<\/code><\/pre>\n<\/div>\n<h2 id=\"\u6ce8\u610f\u8bc1\u4e66\u8981\u6c42\">\u6ce8\u610f\/\u8bc1\u4e66\u8981\u6c42<\/h2>\n<ul>\n<li>\u8bc1\u4e66\u7684\u79c1\u94a5\u7ba1\u7406\u91cc\u9762\u8981\u5141\u8bb8 \u201cNetwork Service\u201d \u8bfb\u53d6\u79c1\u94a5, \u9ed8\u8ba4\u5141\u8bb8\u4e86, \u53ef\u4ee5\u4e0d\u7528\u4fee\u6539. (certlm.msc &gt; \u4e2a\u4eba &gt; \u8bc1\u4e66 &gt; \u9009\u62e9\u8bc1\u4e66 &gt; \u53f3\u952e: \u6240\u6709\u4efb\u52a1 &gt; \u79c1\u94a5\u7ba1\u7406 &gt; \u5b89\u5168)<\/li>\n<li>\u8bc1\u4e66\u5b89\u88c5\u5230 \u201c\u672c\u5730\u8ba1\u7b97\u673a &gt; \u4e2a\u4eba\u201d \u5b58\u50a8\u533a\u57df\u4e2d.<\/li>\n<li>\u8bc1\u4e66\u5fc5\u987b\u6709\u76f8\u5bf9\u5e94\u7684\u79c1\u94a5.<\/li>\n<li>\u8bc1\u4e66\u7684\u7528\u6cd5\u4e3a : \u670d\u52a1\u5668\u8eab\u4efd\u9a8c\u8bc1\u6216\u8005\u8fdc\u7a0b\u684c\u9762\u670d\u52a1\u9a8c\u8bc1(1.3.6.1.4.1.311.54.1.2)<\/li>\n<\/ul>\n<h2 id=\"\u4f7f\u7528\u5176\u4ed6\u5de5\u5177\u751f\u6210\">\u4f7f\u7528\u5176\u4ed6\u5de5\u5177\u751f\u6210<\/h2>\n<p>\u53ef\u4ee5\u9009\u62e9 openssl \u6216\u8005\u5fae\u8f6f\u7684 makecert \u5de5\u5177:<\/p>\n<div class=\"highlight\">\n<pre tabindex=\"0\"><code class=\"language-cmd\" data-lang=\"cmd\">makecert -r -pe -n CN=\"MyServer\" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localmachine -b 01\/01\/2000 -e 01\/01\/2036\r\nwmic \/namespace:\\rootcimv2TerminalServices PATH Win32_TSGeneralSetting Set  SSLCertificateSHA1Hash=\"\u6307\u7eb9\"\r\n<\/code><\/pre>\n<\/div>\n<h2 id=\"\u53c2\u8003\">\u53c2\u8003<\/h2>\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-r2-and-2012\/dn781533(v=ws.11)\">\u5fae\u8f6f\u5b98\u65b9\u6587\u6863\u5173\u4e8e\u8bc1\u4e66\u7684\u8981\u6c42<\/a><\/p>\n<!--wp-compress-html no compression--><!--wp-compress-html-->","protected":false},"excerpt":{"rendered":"\u9ed8\u8ba4\u7684 RDP \u81ea\u7b7e\u540d\u8bc1\u4e66\u6709\u6548\u671f\u53ea\u6709\u534a\u5e74, \u5bf9\u4e8e\u6211\u6765\u8bf4\u592a\u77ed, \u4e00\u65e6\u8fc7\u671f, \u8fde\u63a5 rdp \u65f6\u63d0\u793a\u8bc1\u4e66\u4e0d\u53d7\u4fe1\u4efb\u7684\u8b66\u544a\u5c31\u5f88\u70e6\u607c, \u4fe1\u4efb\u6216\u4e0d\u4fe1\u4efb\u90fd\u9ebb\u70e6. \u53ef\u4ee5\u4f7f\u7528\u514d\u8d39\u6216\u6536\u8d39\u7684 SSL \u8bc1\u4e66, \u5e76\u914d\u7f6e\u81ea\u52a8\u66f4\u65b0\u8bc1 \u00b7\u00b7\u00b7","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[355,356,49],"class_list":["post-1351","post","type-post","status-publish","format-standard","hentry","category-jiaocheng","tag-ssl","tag-356","tag-49"],"views":236,"_links":{"self":[{"href":"https:\/\/aichh.com\/api\/wp\/v2\/posts\/1351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aichh.com\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aichh.com\/api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aichh.com\/api\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aichh.com\/api\/wp\/v2\/comments?post=1351"}],"version-history":[{"count":2,"href":"https:\/\/aichh.com\/api\/wp\/v2\/posts\/1351\/revisions"}],"predecessor-version":[{"id":1353,"href":"https:\/\/aichh.com\/api\/wp\/v2\/posts\/1351\/revisions\/1353"}],"wp:attachment":[{"href":"https:\/\/aichh.com\/api\/wp\/v2\/media?parent=1351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aichh.com\/api\/wp\/v2\/categories?post=1351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aichh.com\/api\/wp\/v2\/tags?post=1351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}