PFX Certificate for FsRdpServer

1. What Is a PFX Certificate?

cert.pfx is a password-protected PKCS#12 package. It contains:

• The TLS server certificate for your server name (e.g. server.ihrefirma.de)
• The private key for the certificate
• Optional: intermediate certificates from the certificate authority

FsRdpServer uses the PFX file to encrypt all client connections, just as a web server uses its HTTPS certificate. Clients cannot connect without a valid certificate.

2. Obtain a Certificate

Option A: Wildcard Certificate (Recommended for Several Servers)

Example: *.ihrefirma.de

• Covers all subdomains: server.ihrefirma.de, support.ihrefirma.de, etc.
• Request it from your domain registrar (e.g. HostEurope).
• Usually paid (EUR 10–50/year depending on the provider).
• Benefit: You can use it for several FsRdpServers under your domain.
• Validity: Typically one year; renew before expiry.

Option B: Specific Certificate (for One Server)

Example: server.ihrefirma.de (this subdomain only)

• Less expensive than a wildcard certificate (EUR 5–30/year).
• Request it from your domain registrar.
• Benefit: Costs less if you only have one server.
• Drawback: Each additional server needs its own certificate.
• Validity: Typically one year; renew before expiry.

Option C: Let's Encrypt (Free, with Automated Renewal)

Example: server.ihrefirma.de

• Free certificates, valid for 90 days, with automatic renewal available.
• Requirement: Your server name must be publicly resolvable via DNS.
• Set up with certbot (Linux; Windows requires additional tools).
• Benefit: Free, with automatic renewal available.
• Drawback: Requires public internet connectivity and DNS management.

Option D: Internal Company CA (Private Networks Only)

If FsRdpServer is only reachable internally and your company operates its own certificate authority, you can request a certificate from it.

• Important: Every client must explicitly trust the CA.
• Validity: Depends on your CA's policy, often one to three years.

3. Export the Certificate as PFX

Scenario A: Obtain It from HostEurope

1. Sign in to the HostEurope customer portal.
2. Navigate to your domain and certificate management.
3. Download the certificate. HostEurope usually offers several formats.
4. Choose the format PKCS#12 (.pfx) with a password.
5. Store cert.pfx securely; do not send it by email.

Scenario B: Let's Encrypt with certbot (Linux)

# Zertifikat mit certbot beschaffen und automatisch erneuern
sudo certbot certonly --standalone -d server.ihrefirma.de

# Dann zu PFX konvertieren:
sudo openssl pkcs12 -export -out /tmp/cert.pfx \
  -inkey /etc/letsencrypt/live/server.ihrefirma.de/privkey.pem \
  -in /etc/letsencrypt/live/server.ihrefirma.de/fullchain.pem \
  -password pass:IhrPasswort

Scenario C: Another CA (Manually with OpenSSL)

If you have separate PEM files (e.g. cert.pem, privkey.pem, chain.pem):

openssl pkcs12 -export -out cert.pfx \
  -inkey privkey.pem \
  -in cert.pem \
  -certfile chain.pem \
  -password pass:IhrPasswort

4. Install the PFX File for the First Time

Windows

Detailed Guide: Installation Guide, Section 3

Linux

sudo install -o fsrdp-server -g fsrdp-server -m 0640 \
  cert.pfx /opt/fsrdp-server/data/cert.pfx

sudoedit /etc/fsrdp-server/fsrdp-server.env

FSRDP_CERT_PASSWORD=IhrPasswort

sudo chmod 0600 /etc/fsrdp-server/fsrdp-server.env

sudo systemctl restart fsrdp-server.service

Detailed Guide: Installation Guide, Section 4

5. Renew the Certificate

Check the Expiry Date

Windows:

# Öffnen Sie die MMC (Microsoft Management Console):
mmc

# Und navigieren Sie zu:
# Datei > Snap-Ins hinzufügen/entfernen > Zertifikate > Eigene Zertifikate >
# Persönlich > Zertifikate

# Dort können Sie das Gültigkeitsdatum der installierten cert.pfx sehen.

Linux:

openssl pkcs12 -in /opt/fsrdp-server/data/cert.pfx -password pass:IhrPasswort \
  | openssl x509 -noout -dates

Scenario A: Renew a HostEurope Certificate

1. HostEurope sends a reminder approximately four to six weeks before expiry.
2. Request renewal in the HostEurope portal.
3. Download the renewed certificate as PKCS#12 (.pfx).
4. Follow “Replace the Certificate (Windows/Linux)” below.

Scenario B: Let's Encrypt with certbot (Linux, Automatic)

Let's Encrypt certificates are valid for only 90 days, but certbot renews them automatically. To check this:

# Manuelle Erneuerung testen (ohne echten Abruf):
sudo certbot renew --dry-run

# Automatische Erneuerung überprüfen (läuft als Systemd-Timer):
sudo systemctl list-timers | grep -i certbot

After certbot renews the certificate, you must export the PFX file again and install it in FsRdpServer:

# Neue PFX erzeugen:
sudo openssl pkcs12 -export -out /tmp/cert.pfx \
  -inkey /etc/letsencrypt/live/server.ihrefirma.de/privkey.pem \
  -in /etc/letsencrypt/live/server.ihrefirma.de/fullchain.pem \
  -password pass:IhrPasswort

# Alte PFX durch neue ersetzen:
sudo install -o fsrdp-server -g fsrdp-server -m 0640 \
  /tmp/cert.pfx /opt/fsrdp-server/data/cert.pfx

# Dienst neu starten:
sudo systemctl restart fsrdp-server.service

Replace the Certificate (Windows)

1. Obtain the renewed certificate as cert.pfx (see sections 2–3).
2. Stop the FsRdpServer service:

   Stop-Service -Name FsRdpServer

3. Replace the old PFX file:

   Copy-Item "C:\Pfad\zu\cert.pfx" `
     "C:\ProgramData\FsRdpServer\cert.pfx" -Force

4. If the password has changed, edit appsettings.json:

   notepad "C:\ProgramData\FsRdpServer\appsettings.json"

   and change:

   "CertificatePassword": "AlterPasswort"

   to:

   "CertificatePassword": "NeuesPasswort"

5. Restart the service and validate:

   Start-Service -Name FsRdpServer
   
   # Validierung:
   & "$env:ProgramFiles\FsRdpServer\FsRdpServer.exe" `
     --validate-installation `
     --validation-data-dir "$env:ProgramData\FsRdpServer"

Replace the Certificate (Linux)

1. Obtain the renewed certificate as cert.pfx.
2. Stop the service:

   sudo systemctl stop fsrdp-server.service

3. Replace the old PFX file:

   sudo install -o fsrdp-server -g fsrdp-server -m 0640 \
     cert.pfx /opt/fsrdp-server/data/cert.pfx

4. If the password has changed, edit the environment file:

   sudoedit /etc/fsrdp-server/fsrdp-server.env

   and update:

   FSRDP_CERT_PASSWORD=NeuesPasswort

5. Validate the installation:

   sudo systemd-run \
     --quiet --wait --pipe --collect \
     --property=User=fsrdp-server \
     --property=Group=fsrdp-server \
     --property=EnvironmentFile=/etc/fsrdp-server/fsrdp-server.env \
     --property=Environment=FSRDP_DATA_DIR=/opt/fsrdp-server/data \
     /opt/fsrdp-server/FsRdpServer --validate-installation

6. If validation succeeds, start the service:

   sudo systemctl start fsrdp-server.service

6. Set Up Automatic Renewal (Linux + Let's Encrypt)

If you use Let's Encrypt with certbot and want the PFX file to be renewed automatically:

Step 1: Create the Hook Script

sudo nano /etc/letsencrypt/renewal-hooks/post/fsrdp-renew.sh

Enter the following content:

#!/bin/bash
# Erneuertes Zertifikat zu PFX konvertieren
openssl pkcs12 -export -out /tmp/cert.pfx \
  -inkey /etc/letsencrypt/live/server.ihrefirma.de/privkey.pem \
  -in /etc/letsencrypt/live/server.ihrefirma.de/fullchain.pem \
  -password pass:IhrPasswort

# PFX zu FsRdpServer kopieren
install -o fsrdp-server -g fsrdp-server -m 0640 \
  /tmp/cert.pfx /opt/fsrdp-server/data/cert.pfx

# Dienst neu starten
systemctl restart fsrdp-server.service

# Temporary file löschen
rm /tmp/cert.pfx

Step 2: Make the Script Executable

sudo chmod +x /etc/letsencrypt/renewal-hooks/post/fsrdp-renew.sh

Step 3: Test

sudo certbot renew --dry-run

The PFX file and service will then be renewed automatically when certbot obtains a new certificate, typically after 90 days.

7. Common Problems

“Certificate has expired” or Clients Cannot Connect

• Check the PFX file's expiry date (see section 5).
• If it has expired, renew the certificate immediately (section 5).

“DNS name mismatch” or Similar Setup Errors

• The certificate's DNS Subject Alternative Name (SAN) does not match the server name.
• Check the name for which the certificate was issued.
• Obtain a new certificate for the correct name.

“PFX password incorrect” or “Falsche PFX-Datei” (Incorrect PFX File)

• Windows: Check in appsettings.jsonthat the password is correct.
• Linux: Check the password in /etc/fsrdp-server/fsrdp-server.env .
• Pay attention to spaces and special characters in the password.

“Invalid certificate chain” or Clients Do Not Trust the Certificate

• Ensure the PFX file contains all required intermediate certificates.
• With Let's Encrypt, use fullchain.pemrather than cert.pem.
• Clients must trust the certificate authority, which is normally the case for public CAs.