Signing Windows RDP Files with a Self-Signed Certificate (1-2. Signing the RDP File)

This article uses the self-signed certificate created in part 1-1 to sign an .rdp file with the Windows rdpsign tool.

It then registers the certificate thumbprint as a trusted RDP publisher in Group Policy so that the publisher warning no longer appears. Finally, it creates a batch file that re-signs RDP files by drag and drop.

The warning covered by this article

This procedure addresses the security warning displayed when opening an .rdp file:

Remote Desktop Connection security warning
Verify the publisher of this remote connection

This warning concerns the publisher of the .rdp file itself.

It is separate from TLS certificate warnings for the destination RDP server, such as:

The identity of the remote computer cannot be verified

Microsoft explains that an RDP file signature helps identify its creator or distributor and detect modification. A signature does not guarantee that the file itself is safe.

Prerequisites

Confirm that part 1-1 is complete:

• My RDP Publisher exists under Cert:\CurrentUser\My.
• Its HasPrivateKey property is True.
• C:\RDPs\MyRdpPublisher.cer exists.
• The target example.rdp file exists.

This article uses the following example layout:

C:\RDPs\
├─ MyRdpPublisher.cer
├─ example.rdp
└─ sign_rdp_dragdrop.bat

Check the rdpsign help on the current PC

Windows updates can change behavior and documentation, so first check the help for the installed rdpsign:

rdpsign /?

On the Windows 11 system checked here, rdpsign.exe version 10.0.26100.8875 describes /sha256 HASH as the SHA-256 hash of the signing certificate.

The current Microsoft Learn page also says /sha256 replaces /sha1 on Windows Server 2016 and later and describes its argument as the certificate’s SHA-256 thumbprint.

Thumbprint format verified in the working environment

However, in the environment where this procedure was tested, signing succeeded when the 40-character, space-free value from the certificate store’s Thumbprint property was passed in this form:

rdpsign /sha256 0123456789ABCDEF0123456789ABCDEF01234567 "C:\RDPs\example.rdp"

The 40-character value shown here is a placeholder. Replace it with the value from your own certificate:

$cert = Get-ChildItem 'Cert:\CurrentUser\My' |
    Where-Object Subject -eq 'CN=My RDP Publisher' |
    Sort-Object NotBefore -Descending |
    Select-Object -First 1

$cert.Thumbprint

Microsoft Learn and the local help use the phrase “SHA256 hash,” while the value that worked in the tested environment was the traditional 40-character X509Certificate2.Thumbprint. This article preserves the command that actually worked instead of silently changing it. After a Windows update or on another PC, check rdpsign /? and Microsoft Learn, and use /l to test before overwriting the file.

Test signing without overwriting the file

Microsoft Learn documents /l as testing signing and output without replacing the input file:

rdpsign /sha256 0123456789ABCDEF0123456789ABCDEF01234567 /l "C:\RDPs\example.rdp"

Normal signing overwrites the input file. Make a backup first if needed:

Copy-Item 'C:\RDPs\example.rdp' 'C:\RDPs\example.before-signing.rdp'

Sign the RDP file

If the test succeeds, sign the file:

rdpsign /sha256 0123456789ABCDEF0123456789ABCDEF01234567 "C:\RDPs\example.rdp"

Make sure spaces or invisible characters were not introduced when copying the thumbprint.

Verify the signature

An .rdp file is a text file, so its before-and-after versions can be compared. Signing adds entries such as these near the end:

signscope:s:...
signature:s:...

The values are long and do not need to be pasted into an article or log. Check for the fields with:

Get-Content 'C:\RDPs\example.rdp' |
    Select-String '^(signscope|signature):s:'

When the signed file is opened, the certificate subject is recognized as the publisher:

Publisher: My RDP Publisher

Editing a signed RDP setting changes signed content, so sign the file again after editing it.

Register the certificate as a trusted RDP publisher

Signing alone can still leave the publisher verification warning visible. Register the certificate used for signing as a trusted RDP publisher.

Press Win + R and run:

gpedit.msc

Navigate to:

Computer Configuration
  → Administrative Templates
    → Windows Components
      → Remote Desktop Services
        → Remote Desktop Connection Client

The current Microsoft Learn name for the policy is:

Specify thumbprints of certificates representing trusted .rdp publishers

Before the July 2026 security update, the policy name explicitly referred to SHA-1:

Specify SHA1 thumbprints of certificates representing trusted .rdp publishers

The displayed name can differ with the Windows version and installed administrative templates.

Set the policy to Enabled and register the certificate thumbprint.

In the tested environment, adding the space-free, 40-character Thumbprint from the certificate store stopped the security warning:

0123456789ABCDEF0123456789ABCDEF01234567

This value is only a placeholder.

Current Microsoft Learn documentation says that the policy supports SHA-2 thumbprints after the July 2026 update and treats SHA-1 thumbprints as backward compatibility. Required prefixes for SHA-2 registration can depend on the installed update, so follow the format shown in the policy’s local Help pane. Do not guess the prefix.

Apply the updated policy:

gpupdate /force

If necessary, close every running mstsc.exe process and reopen the signed .rdp file.

Confirm that the warning is gone

In the tested environment, the publisher warning disappeared with this sequence:

• Pass the certificate store’s 40-character Thumbprint to rdpsign /sha256.
• Register the same 40-character value in the trusted RDP publishers policy.
• Run gpupdate /force.
• Close mstsc.exe and reopen the signed .rdp file.

This is the observed result for the tested environment. It is recorded separately from the current Microsoft recommendation to use a SHA-2 thumbprint.

Drag-and-drop signing batch file

An RDP file needs to be signed again after it is edited. Save the following as C:\RDPs\sign_rdp_dragdrop.bat:

@echo off
setlocal EnableExtensions

set "CERT_FILE=%~dp0MyRdpPublisher.cer"

if not exist "%CERT_FILE%" (
    echo エラー: 証明書ファイルが見つかりません。
    echo.
    echo %CERT_FILE%
    echo.
    pause
    exit /b 1
)

set "THUMBPRINT="

for /f "usebackq delims=" %%H in (`powershell.exe -NoProfile -Command "$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('%CERT_FILE%'); $cert.Thumbprint"`) do (
    set "THUMBPRINT=%%H"
)

if not defined THUMBPRINT (
    echo エラー: 証明書の Thumbprint を取得できませんでした。
    echo.
    pause
    exit /b 1
)

echo 使用する証明書:
echo   %CERT_FILE%
echo.
echo Thumbprint:
echo   %THUMBPRINT%
echo.

where rdpsign >nul 2>nul
if errorlevel 1 (
    echo エラー: rdpsign が見つかりません。
    echo Remote Desktop 関連機能が入った Windows 環境で実行してください。
    echo.
    pause
    exit /b 1
)

powershell.exe -NoProfile -Command ^
    "$thumb = '%THUMBPRINT%';" ^
    "$cert = Get-ChildItem Cert:\CurrentUser\My,Cert:\LocalMachine\My -ErrorAction SilentlyContinue |" ^
    "Where-Object { $_.Thumbprint -eq $thumb -and $_.HasPrivateKey } |" ^
    "Select-Object -First 1;" ^
    "if ($null -eq $cert) { exit 1 } else { exit 0 }"

if errorlevel 1 (
    echo エラー: 秘密鍵付きの証明書が Windows 証明書ストアに見つかりません。
    echo.
    echo .cer ファイルだけでは署名できません。
    echo 同じ証明書の秘密鍵付き証明書が
    echo CurrentUser\My または LocalMachine\My に必要です。
    echo.
    pause
    exit /b 1
)

if "%~1"=="" (
    echo .rdp ファイルをこのバッチへドラッグ^&ドロップしてください。
    echo.
    pause
    exit /b 1
)

set "FAILED=0"

:loop
if "%~1"=="" goto done

if /i not "%~x1"==".rdp" (
    echo スキップ: "%~1" ^(.rdp ファイルではありません^)
    shift
    goto loop
)

echo.
echo 署名中: "%~1"

rdpsign /sha256 %THUMBPRINT% "%~1"

if errorlevel 1 (
    echo 失敗   : "%~1"
    set "FAILED=1"
) else (
    echo 成功   : "%~1"
)

shift
goto loop

:done
echo.

if "%FAILED%"=="0" (
    echo すべて完了しました。
    exit /b 0
) else (
    echo 一部失敗しました。
    pause
    exit /b 1
)

The batch file:

1. Finds MyRdpPublisher.cer beside the batch file.
2. Reads the thumbprint from the .cer file with PowerShell.
3. Confirms that a certificate with the same thumbprint and a private key exists under CurrentUser\My or LocalMachine\My.
4. Checks that each argument has an .rdp extension.
5. Signs the file with rdpsign.
6. Processes multiple RDP files when they are dropped together.

%~dp0 is the directory containing the running batch file. A relative setting such as set "CERT_FILE=.\MyRdpPublisher.cer" can refer to another current directory when launched by drag and drop or through a shortcut, so this batch file uses %~dp0.

Copying only the CER file is not enough

The batch file reads the thumbprint from MyRdpPublisher.cer, but the CER file does not contain the private key.

To use the same batch file on another PC, restore the private-key certificate from the PFX backup described in part 1-1 into CurrentUser\My or LocalMachine\My.

Security considerations

This procedure does not disable all RDP security warnings. It trusts only RDP files signed by the specified publisher certificate.

Do not enable the policy that allows RDP files from unknown publishers merely to remove a warning.

Anyone who obtains the signing certificate’s private key can sign an RDP file as the same publisher. Protect the PFX file and its password carefully.

A signed RDP file is not automatically safe. Its signature helps identify the publisher and detect modifications; it does not guarantee the safety of the destination or redirection settings.

Summary

The complete setup is:

1. Create a self-signed certificate for RDP file signing.
2. Sign the RDP file with rdpsign /sha256.
3. Add the same certificate’s thumbprint to the trusted RDP publishers policy.
4. Run gpupdate /force and reopen the signed file.
5. Use the drag-and-drop batch file for later re-signing.

In the tested environment, the 40-character certificate Thumbprint worked for both signing and Group Policy. Current Microsoft documentation recommends SHA-2 thumbprints, so also check the installed rdpsign help and the policy Help pane after Windows updates.

References

• rdpsign - Microsoft Learn
• RDP file security settings in Group Policy - Microsoft Learn
• Understanding security warnings when opening RDP files - Microsoft Learn