Resolving "This computer can't verify the identity of the RDP Gateway" Error

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Users encounter a certificate validation error when attempting to establish an RDP session through the PAM RDP Gateway. This prevents a secure connection to the target server via PAM.

Error Message when accessing RDP Gateway
"This computer can't verify the identity of the RDP Gateway '<PAM Gateway Address>'. It's not safe to connect to servers that can’t be identified."
"An authentication error has occurred (Code: 0x80070057)"

Environment

CA Privileged Access Manager (PAM) RDP Gateway functionality

Cause

The primary cause of this error is an invalid or improperly configured certificate on the PAM server (where the RDP gateway runs), specifically related to the Subject Alternative Name (SAN) list or the overall trust of the certificate on the client machine.

Resolution

1. Verify Certificate Configuration on PAM Server:

- Ensure the certificate installed on the PAM server includes the Fully Qualified Domain Name (FQDN) of the PAM Gateway in its Subject Alternative Name (SAN) list.
- If the FQDN is missing from the SAN, regenerate the certificate on the PAM Server, ensuring the FQDN is included.
- Re-install the newly generated certificate on the PAM Server.

2. Import the PAM Server Certificate on the Client Machine:

- Delete Existing Certificates: On the client machine encountering the error, delete any existing certificates related to the PAM Gateway from the following locations in certmgr.msc:
    - Local Computer -> Trusted Root Certification Authorities -> Certificates
    - Personal -> Certificates (if applicable)

- Download the Latest Certificate: Access the PAM Gateway URL (e.g., https://<PAM Gateway Address>) from the client machine.
- Download the Certificate: Download the certificate from the browser (the exact steps vary depending on the browser, but typically involve clicking on the padlock icon in the address bar, then "Certificate" or "Connection secure," and then exporting the certificate).
- Import the Certificate: Import the downloaded certificate into the following stores on the client machine:
   - Local Computer -> Trusted Root Certification Authorities -> Certificates
   - (Optional, but recommended) Personal -> Certificates

3. Address "Windows does not have enough information to verify this certificate" Warning (if present):

- This warning indicates that the client system cannot properly validate the digital certificate. This often points back to the certificate chain not being fully trusted or the root CA not being present on the client.
- Engage your Security Team or Certificate Authority (CA) administrator to verify the entire certificate chain (intermediate CAs and root CA). Ensure all necessary certificates in the chain are correctly installed and trusted on the client machine.

4. When the Autotlogin is disabled, certificate issue is resolved and yet having the Authentication Error (Code: 0x80070057) this could indicate yet to be a separate, but related, issue refered to Broadcom Article 382308 Article: This article addresses the "An authentication error has occurred (Code: 0x80070057)" when connecting through PAM Gateway. Key suggestions include:
  - Configuring a target account for the device you are attempting to access through the CA PAM RDP Gateway and associating it with the device and connection prior to attempting the connection again.
  - In Windows, clear the checkbox for "Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)" within the Remote Desktop Configuration under the Windows target device's Control Panel.

5. Investigate Network Level Authentication (NLA) Settings: If the issue persists without autologin, explore further troubleshooting steps related to NLA, potentially involving netsh commands or reviewing Group Policy settings (e.g., "Encryption Oracle Remediation").

Additional Information

Logs: Share with Broadcom Support the steps that were tried,  logs.bin,  session logs from PAM Server being used,  for more specific error details related to the authentication failure that  may help Support finds a solution.