This information came from:
http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/thread/d87e7b67-e057-471b-9015-8afac51008ec
And was written by
Justin Davidow
I linked to the first document in my original post, I was wary of it's use: SBS is a small business product that people constantly mention NOT to do anything without using the SBS console.
I've never been impressed with SBS, this whole "the role is installed.. but.. we didn't install any of the management tools.." sounds like a hack. I'm sorry, hack != production.
For those interested in the procedure of implementing a wildcard certificate to allow RDP connections via Remote Web Workplace (in my case it was a Comodo EssentialSSL Wildcard certificate)
As of 8/17/2012, for SBS 2011 Service Pack 1 - the procedure is:
- CLOSE the SBS console
- Start -> Administrative Tools -> IIS Manager (not the v6 manager)
- Connections -> servername -> Server Certificates
- "Create Certificate Request" in the actions menu on the right hand side
- "Common Name" must be " *.domainname.tld "
- Submit the CSR file/text to your CA (this process will vary based on the CA)
- When you receive the response, (this may be 3 minutes, this may be days later) Return to the Server Certificates menu (via step 2+3 above)
- Select "Complete Certificate Request" under the actions menu.
- Complete the wizard which installs the certificate in the personal store. (the name is misleading, don't worry about it!)
- Bind the certificate to the default website: under Connections -> Servername -> Sites -> Default Web Site, select "edit bindings" on the actions menu on the right
- Select the first HTTPS entry and click "edit"
- Select your new SSL certificate and press OK
- Repeat these steps for the other HTTPS entries in the list
- Restart IIS by selecting "Restart" under the actions menu in IIS
- Close IIS
- Open an Administrative Command prompt, (start-> All Programs-> Accessories->right-click Command Prompt and select "run as administrator")
- Execute the following command (without quotations): "dism /online /Enable-Feature:Gateway-UI"
- Open Remote Desktop Gateway Manager, start->run-> "mmc" -> ok, File -> Add/remove Snap-in -> click "Remote Desktop Gateway Manager" and hit "add" then OK
- When you click on RD Gateway manager, it will pop up and inform you that there's a problem. CLICK NO. DO NOT CLICK YES.
- Expand the RD gateway manager, saying NO to any questions it asks you, right click on your servername, and select properties.
- Again, ALWAYS ANSWER NO TO ANY QUESTIONS IS ASKS YOU!
- On the SSL certificate Tab, click the "import certificate" button (again, technically badly named. it means "select certificate", It copies the certificate from the personal store to the Remote Desktop store)
- Select the certificate you purchased. Hit OK
- Ensure that the details correctly populate the "Issued to" and "Issued by" fields, then hit OK.
- Close the MMC console window (do not save the window, in fact do not open the RD gateway manager again. almost anything you change in SBS will break things, including your ability to RDP to the machine!)
- Go to a remote computer and try connecting. Your connection to "remote.yourdomain.tld" should now work, if you attempt to RDP to an internal machine, it should now work. On the first run you will still get an error about the RDP connection being signed by an unknown publisher, this will still allow you to connect.
You're done! congratulations!
