4 ms·
No, the RDP authentication works using a Username/Password-pair displayed in the Life Cycle Services control panel. The shared private key was used to encrypt
by mgliwka 9y ago
No, the RDP authentication works using a Username/Password-pair displayed in the Life Cycle Services control panel.
The shared private key was used to encrypt and authenticate the web traffic for all customers.
- moondev 9y agoI see, I agree that is still pretty bad. Wonder how many other RDP+IIS products use wildcard certs and share this same vulnerability to leak keys?
- paulirwin 9y agoIt makes sense that their "quick" solution is to give each customer their own cert/key, but I'm surprised that they didn't go with a reverse proxy approach from the beginning, where the wildcard key would be kept securely at their reverse proxy layer that no customers would have access to. Having to maintain TLS certs in IIS on each of these VMs seems like it would cause them more work than it's worth. Having experience with the platform, do you have any insight into why they would do TLS at the VM rather than via a reverse proxy?
- mgliwka 9y agoAs far as I remember, there was already a Powershell script as part of their deployment mechanism in place to deploy the certificates in the first place. Just the certificate provided to this script was a wildcard one. I agree on the reverse proxy part, but am not familiar enough with the product and Microsofts history to comment on that.