How do I see an old Remote Desktop certificate?

Question

A certain server to which I connect using Remote Desktop running under Windows 7 has a self-signed certificate. The first time I connected and was presented with the certificate warning, I ticked the box "Don't ask me again for connections to this computer".

I'm now seeing the warning again, and there's a new certificate. I want to check the previous certificate's expiry date, because if it has just expired that would reassure me that there's a good reason for seeing a new certificate.

Where would I be able to find the old certificate?

I've tried looking in Certificate Manager (both under "current user" and "local machine"), and it's not there; I've found a certificate hash in the registry (under various roots \Software\Microsoft\Terminal Server Client\Servers\the.host.name), but no other registry entries with the same value.

Answer 1

The server certificate is not stored on your PC. When you check the box "Don't ask me again" the thumbprint is store in the Windows Registry under HKCU\Software\Microsoft\Terminal Server Client\Servers\<server name> in the binary value CertHash. The presence of this value indicates that a certificate with that thumbprint presented by that server is to be trusted explicitly by mstsc.exe.

The only way to view the old certificate is to use the certificate management console on the server in question, assuming the administrator did not delete the old certificate. You may or may not have rights to view the certificate store on the server.