One of our Helpdesk personnel got the following error when making an RDP connection from Windows XP SP3 to a Windows Server 2008 R2 server, “Remote Desktop cannot connect to the remote computer because the authentication certificate received from the remote computer is expired or invalid. In some cases, this error might also be caused by a large time discrepency between the client and server computers.”
Since the error suggested it I checked the date, time, & time zone on both the server & client but they are all correct. I tried to RDP to the same server & was able to log in just fine, however I was using Windows 7.
On the server if I open the certificate store in an MMC & browse to the Remote Desktop\Certificates I see that there is a self-signed certificate that expired on 5/3/2011.
If I look at the same store in other 2008 R2 & 2008 SP2 servers they all have a self-signed certificate as well but the expiration dates have not yet passed. It appears as though this certificate should be renewing itself automatically every 6 months but for some reason on this one server it is not. While I could never find any documentation on the mechanics behind this certificate auto-renewing itself the fix is pretty simple. You just need to restart the Remote Desktop Configuration service. The expired certificate will then be renewed.
You will also see an Event ID 1056 in the System log that says, “A new self signed certificate to be used for Terminal Server authentication on SSL connections was generated. The name on this certificate is servername.domain.tld. The SHA1 hash of the certificate is in the event data.”
Update: I have also found this same issue on Windows Server 2008 RTM, SP1, and SP2. The same fix applies only the service to restart is Terminal Services Configuration.