1

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions.

Right after doing this, I was able to RDP to a server inside my LAN without being prompted for a finger print change.

One day later, however, as I try to connect to that same server, it is now prompting me to accept a new certificate because the fingerprint has changed.

I have a suspicion that the new networking equipment is trying to gather the credentials of my servers by intercepting my RDP sessions in a manner that would be otherwise transparent except for the fact that I'm being prompt to accept a changed certificate.

How can I confirm that this finger print change's source is something that has occurred on the server I'm connecting to, and not due to the new networking equipment trying to do a man in the middle attack to catalog credentials on my network (that it should not be curious about)?

Improve this question

1 Answer 1

Reset to default
1

This can be narrowed down to a single device by first investigating the certificate on the server itself (access the console and RDP localhost to get the current certificate). Then, with a client computer, move farther away one network device at a time.

Once you've found the culprit, investigate the configuration: it could be a legitimate feature you have turned on by accident.

Improve this answer
3
  • 3
    Or the server had a self-issued certificate which expired after 365 days, and the server generated a new one. (If OP's servers had CA-issued certificates, there would have been no "fingerprint prompt".)
    – grawity
    Commented Apr 1, 2019 at 10:29
  • True. This answer is more about methods for finding the reason, not guessing what it could be. :)
    – Esa Jokinen
    Commented Apr 1, 2019 at 10:37
  • 1
    Some steps about finding the cert would have been nice in this answer, but I did find the cert and the new finger print did indeed match what was on the server. So no man in the middle here. Thank you.
    – Lonnie Best
    Commented Apr 1, 2019 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .