Spent (wasted) about 20 hours or so trying to resolve certificate issues with RDS 2012r2.
Currently I have decided the best approach would be to get a SAN certificate from a 3rd party service that contains 2 wildcard certificates (*.domain.net, *.internal.domain.net) (the second was a screwup from the guys who originally built the domain, all
internal FQDNs are server.internal.domain.net). The common name on the certificate is *.domain.net.
My understanding would be that any server with an FQDN of *.domain.net or *.internal.domain.net would be covered by this certificate. Currently I'm only working with internal addresses so only the *.internal.domain.net is relevant.
I have Windows NLB running on two servers that are both Connection Brokers, Sessions Hosts, and Web Hosts with HA configured between the Connection Brokers. The NLB DNS A record is 'RDAPP' pointing to the correct IP. (Note: I have done this with round robin
to the same result)
When I connect to 'RDAPP' via RDP I am given the Name Mismatch prompt
"Requested remote computer:
RDAPP
Name in the certificate from the remote computer:
*.domain.net"
When I view the certificate I see in the "Subject Alternative Name"
DNS Name=*.domain.net
DNS Name=*.internal.domain.net
The FQDN of the NLB DNS name is RDAPP.internal.domain.net which should be covered by the second wildcard.
The Certificate is correctly installed on all servers and clients used for testing. I've tested also on a linux thin client non-domain joined and get the same mismatch.
Let me know if I'm missing something simple or what else I should try next. Really out of ideas here. Have used every type of certificate from our internal Root CA, have tried multiple 3rd party certificates in various formats. My original farm worked fine
but it crashed and burned due to the silly 2012 architecture and the 3 other farms I've brought up have this same issue.