I need to distribute signed RDP connection shortcuts to a mix of domain users and people outside the organization. I want the signature to remain trusted after the code-signing certificate expires, so timestamping is important. Several certificate providers have been vague about whether their OV code-signing certificates can sign .rdp files and whether timestamping is supported. What certificate and signing process would you recommend?
2 Answers
Timestamping usually isn’t a special feature that has to be built into the code-signing certificate. You sign the file with the certificate, then add a trusted timestamp from a timestamping service. As long as the timestamp was applied while the certificate was valid, the signature can remain valid after the certificate expires. Check that your signing tool supports Authenticode signing of .rdp files and use a trusted timestamp endpoint.
It’s worth considering whether the RDP file itself needs to be signed, or whether configuring a trusted certificate on the RDP server would solve the warning more cleanly. However, if users outside the domain need to connect and won’t receive your organization’s internal trust settings, distributing a signed shortcut may be useful. Timestamping is separate from the OV certificate, so ask the provider about file compatibility and use an independent trusted timestamp service.
The external users are the main reason I’m looking at signing the connection files rather than relying only on domain-based trust.