Hi,
Been fighting with Server 2012 to get certs set up properly in RD. (Overall I'm finding things counter-intuitive on this server OS.)
I have an internal Public Key Infrastructure set up with an off-line root CA and an issuing Enterprise CA. All the clients will trust the root cert.
I use Certificates (Local Computer) to request two certs - one for the gateway and web, and the other for the broker roles. Everything RD is on the same server right now. (I just didn't want to use the same cert on both because the gateway is outfacing and I don't want to include the machine's internal DNS name in that cert - only the gateway's public DNS.) I'm using the "Web Server" template for both.
I import them from my issuing CA (it doesn't issue automatically) to the computer's Personal store and then export them to files in order to be able to get them into the certs page under "Deployment Properties" in Server Manager. (I find it a little silly that I can't reference them from the computer's cert store like I can in the separate RD Gateway Manager application which unfortunately has no analog I can find for the other RD roles.)
In the "Select Existing Certificate" dialog, I "Choose a different certificate" and provide the path and password.
However, I cannot click OK unless I elect to "Allow the certificate to be added to the Trusted Root Certification Authorities certificate store on the destination computers."
I'm not even sure what it means by "destination computers," but I know I don't want this cert in the Trusted Root Certification Authorities of any given computer. I see no reason for it, as it will be trusted anyway on the basis of the root cert it chains from. I would rather not have needless certs floating around in trusted roots, both because it's clutter and because I'm not even sure if clients do revocation checks on trusted roots - I think I remember reading somewhere that they don't.
So, what's going on, why do I have to accept this unwelcome trusted root, and is there some way I can avoid it?
Thank you for any advice or insight.
Kevin