Microsoft has published its monthly security updates. Many updates address Routing and Remote Access Service (RRAS) vulnerabilities commonly used in Always On VPN deployments. In addition, an update addresses a vulnerability in Active Directory Certificate Services (AD CS). Always On VPN user and device authentication often rely on AD CS-issued certificates.
RRAS Updates
The April 2025 Microsoft security updates include the following CVEs for Windows Server RRAS.
Only one of these CVEs (26668) is a Remote Code Execution vulnerability. The others are information disclosure vulnerabilities. None of these vulnerabilities are rated Critical; all are rated Important.
AD CS Update
This month’s security update includes the following CVE for AD CS.
CVE-2025-27740 – AD CS Elevation of Privilege Vulnerability
In a recent post, I described some of the security benefits of using Transport Layer Security (TLS) with Microsoft SQL Server. Configuration changes are required to take full advantage of these capabilities. By default, SQL Server uses an unmanaged, self-signed certificate, which provides little security value. The best practice is to use a certificate issued by the organization’s enterprise PKI. In this guide, I’ll demonstrate how to prepare and deploy a certificate template for SQL server using Active Directory Certificate Services (AD CS), enroll for the certificate, and configure SQL server to use the new certificate for TLS connections.
Note: I have recorded a video demonstration for enabling TLS in Microsoft SQL Server 2022 on my YouTube channel here. Enjoy!
Certificate Requirements
The minimum recommended requirements for a TLS certificate for SQL Server 2022 are:
Subject Name = Server’s fully qualified domain name or the alias name of the cluster
2048-bit RSA key with SHA256
Server Authentication EKU (1.3.6.1.5.5.7.3.1)
Certificate Template
Administrators must prepare a certificate template in Active Directory (AD) adhering to the requirements listed above. On an issuing certification authority (CA) or an administrative workstation with the Remote Server Administration Tools (RSAT) installed, open the Certificate Templates management console (certtmpl.msc) and perform the following steps.
Right-click the default Web Server template and choose Duplicate Template.
Select the Compatibility tab.
In the Compatibility Settings section, select the latest version of Windows Server supported by your issuing CA servers from the Certification Authority drop-down list.
Select Windows 10/Windows Server 2016 from the Certificate recipient drop-down list.
Select the General tab.
Enter a descriptive name in the Template display name field.
Select a validity period of 1 year with a renewal period of 6 weeks.
Select the Cryptography tab.
Select Key Storage Provider from the Provider Category drop-down list.
Select RSA from the Algorithm name drop-down list.
Enter 2048 in the Minimum key size field.
Select SHA256 from the Request hash drop-down list.
Select the Issuance Requirements tab.
Check the box next to CA certificate manager approval.
Select the Subject Name tab.
Select Supply in the request.
Select the Extensions tab.
Select Application Policies.
Ensure that Server Authentication is the only application policy listed.
Select the Security tab.
Click Add.
Grant Read and Enroll permissions to the SQL Server security group or the SQL server’s computer account.
Ensure no other users/groups have enroll permission.
Once complete, publish the certificate template on all issuing CA servers in the organization.
Enroll Certificate
The certificate enrollment process involves several steps.
Request Certificate
To enroll for a new TLS certificate, open the computer certificate management console (certlm.msc) on the SQL server and perform the following steps.
Right-click on the Personal folder and choose All Tasks > Request New Certificate.
Click Next.
Click Next.
Check the box next to the SQL server certificate template.
Click the More information is required to enroll for this certificate. Click here to configure settings link.
Select the Subject tab.
In the Subject Name section, select Common Name from the Type drop-down list.
Enter the SQL server’s fully qualified domain name (FQDN) or the alias name of the SQL cluster in the Value field.
Click Add.
In the Alternative name section, select DNS from the Type drop-down list.
Enter the SQL server’s fully qualified domain name (FQDN) or the alias name of the SQL cluster in the Value field.
Click Add.
[OPTIONAL] Enter the SQL server’s single-label hostname in the Value field.
Note: Adding the single-label hostname to the Subject Alternative Name list allows administrators or applications to connect to the SQL server using its short name (NetBIOS name) without resulting in a subject name mismatch error.
Click Add.
Click Ok.
Click Enroll. The status should indicate that enrollment is pending.
Click Finish.
Approve Certificate
Once the certificate request is made, the request must now be approved. On an issuing certification authority (CA), or an administrative workstation with the Remote Server Administration Tools (RSAT) installed, open the Certification Authority management console (certsrv.msc) and perform the following steps.
Expand the CA.
Select Pending Requests.
Note the request ID for the pending request. After approval, the request ID will be required later to retrieve the certificate.
Right-click the pending request and choose All Tasks > Issue.
Important Note: I am performing the above tasks in a test lab environment. On a properly configured CA in a production environment, the requestor should not be able to approve their own request. In your environment, you may need to request that a CA administrator review and approve your request.
Install Certificate
Once the certificate has been approved and issued, open an elevated PowerShell or command window on the SQL server and perform the following steps.
Enter certreq.exe -retrieve <request ID>.
Select the CA where the certificate was issued.
Click Ok.
Select a location and enter a name for the file in the File name field.
Click Save.
Enter certreq.exe -accept <path to certificate file>.
Configure Certificate
Once the certificate has been enrolled on the SQL server, expand Personal > Certificates and refresh the view to confirm certificate enrollment. Next, perform the following steps.
Right-click the SQL server certificate and choose All Tasks > Manage Private Keys.
Click Add.
Enter the name of the SQL server domain service account and click Check Names.
If using the default SQL server service account, perform the following steps.
Click on Locations.
Select the local server.
Click Ok.
Enter NT Service\MSSQLSERVER and click Check Names.
Click Ok.
Uncheck Full control. The only permission required is Read.
Click Ok.
SQL Configuration
Next, the new certificate must be assigned to the SQL Server service. Open the SQL Server Configuration Manager (sqlservermanager16.msc) and perform the following steps.
Expand SQL Server Network Configuration.
Right-click Protocols for MSSQLSERVER and choose Properties.
Select the Certificate tab.
Select the new certificate from the Certificate drop-down list.
Select the Flags tab.
Select Yes next to Force Strict Encryption.
Click Ok.
Restart the SQL Server service for the changes to take effect.
Important Note: Selecting Force Strict Encryption will force encryption and certificate validation for all clients connecting to the SQL server. It will override any settings to bypass encryption or certificate checks. Force Strict Encryption may not be compatible with older applications or drivers. Please test thoroughly before enabling this setting.
After completing the configuration steps above, administrators can be assured that all communication between clients and the SQL server is fully protected with TLS using modern cryptography and their enterprise-managed certificate. With TLS enabled for SQL server communication, security is enhanced by encrypting data in transit, ensuring authentication, and protecting sensitive information from interception. In addition, this configuration helps meet compliance requirements.
The Remote Desktop Protocol (RDP) is arguably the most widely used protocol for Windows remote server administration. RDP uses Transport Layer Security (TLS) for server authentication, data encryption, and integrity. However, the default configuration of TLS for RDP in Windows is less than ideal.
RDP Self-Signed Certificate
By default, RDP uses a self-signed certificate for TLS operations. TLS with self-signed certificates is a bad security practice because they are not validated by a trusted certificate authority (CA), making it impossible for clients to verify the authenticity of the server they are connecting to, which can lead to interception attacks.
Certificate Warning
Most administrators have encountered a warning error when connecting to a remote host via RDP using a self-signed RDP certificate.
“The remote computer could not be authenticated due to problems with its security certificate. It may be unsafe to proceed.”
Nmap
You can view the default self-signed certificate with the Nmap utility by running the following command.
nmap.exe -n -p 3389 <hostname> –script ssl-cert
Managed Certificates
A better solution for RDP TLS is to use managed certificates issued by an enterprise Public Key Infrastructure (PKI) such as Microsoft Active Directory Certificate Services (AD CS). AD CS is widely deployed in AD domain environments and can be configured to issue certificates for RDP TLS.
AD CS
To configure AD CS to issue RDP certificates, perform the following steps.
Certificate Template
On an issuing CA or an administrative workstation with the Remote Server Administration Tools (RSAT) installed, open the Certificate Templates management console (certtmpl.msc) and perform the following steps.
*My apologies for the list numbering format issues below. Microsoft Word and WordPress can’t seem to agree on the list format. Hopefully, you can figure it out, though. 🙂
Right-click the Workstation Authentication template and choose Duplicate Template.
Select the Compatibility tab.
Select the operating system (OS) version corresponding to the oldest OS hosting the issuing CA role in your environment from the Certification Authority drop-down list.
Select the OS version corresponding to your environment’s oldest supported server or client OS from the Certificate recipient drop-down list.
Select the General tab.
Enter a descriptive name in the Template display name field.
Select an appropriate validity period for your environment. The best practice is to limit the validity period to one year or less.
Select the Cryptography tab.
From the Provider Category drop-down list, choose Key Storage Provider.
From the Algorithm name drop-down list, choose RSA.
In the Minimum key size field, enter 2048.
From the Request hash drop-down list, choose SHA256.
Select the Subject Name tab.
From the Subject name format drop-down list, select DNS name.
Ensure that DNS name is also checked in the subject alternate name section.
Select the Extensions tab.
Click on Application Policies.
Click Edit.
Select Client Authentication.
Click Remove.
Click Add.
Click New.
Enter Remote Desktop Authentication in the Name field.
Enter 1.3.6.1.4.1.311.54.1.2 in the Object identifier field.
Click Ok.
Select Remote Desktop Authentication.
Click Ok.
Select the Security tab.
Click Domain Computers.
Grant the Read and Enroll permissions.
Click Ok.
Next, open the Certification Authority management console (certsrv.msc) and follow the steps below to publish the certificate.
Expand the CA.
Right-click Certificate Templates and choose New > Certificate Template to Issue.
Select the Remote Desktop Authentication certificate template.
Click Ok.
Group Policy
Next, on a domain controller or a workstation with the RSAT tools installed, open the Group Policy Management console (gmpc.msc) and perform the following steps to create a new GPO to enroll domain computers for the Remote Desktop Authentication certificate
Right-click Group Policy Objects and choose New.
Enter a descriptive name for the GPO in the Name field.
Double-click Server authentication certificate template.
Select Enabled.
Enter the name of the Remote Desktop Authentication certificate template in the Certificate Template Name field. Note: Be sure to enter the template name, not the template display name!
Click Ok.
Once complete, link the GPO to the domain or OU to target the servers and workstations to which you wish to deploy the RDP certificate.
Validate Certificate
After updating group policy on a target resource, you’ll find that Nmap now shows the enterprise PKI-issued certificate used for RDP connections.
