For a web server, one can purchase a certificate from a CA to provide secure connection (server authentication and data encryption).

But in cases of remote desktop apps like MS Remote Desktop or TeamViewer, how do they establish a secure connection between the remote client and the target PC?

It seems in this case the target PC is a sort of server, so it must have a domain name and a certificate to provide TLS, right? But in most cases it is likely that the target PC does not have a domain name nor a certificate.

Is there any other way to establish a secure connection in this case?

1 Answer 1


Details may vary but between setups and products. A common approach is to have a trusted third party (like the product vendor) who mediates the connection. Both endpoints of the remote desktop authenticate themselves against this "master" and also trust this master - and this way the master can mediate a trusted connection between both endpoints. This approach is used in products like TeamViewer, AnyDesk, Google Remote Desktop etc. See also this documentation from TeamViewer. This achieves a similar effect to certificates - establishing a trust relationship with the help of a commonly trusted third party.

MS Remote Desktop is different though. It expects a direct connection, which also means that it is not possible to reach an internal system from outside without port forwarding on the firewall (usually not a good idea, since it provides direct unfiltered access into the internal network) or without having some VPN access to the internal network. And even if the system does not have a public domain name it still can be reached by its IP address. Windows also provides a way to associate a certificate with the RDP server and such certificate can also be used to authenticate only an IP address if this is really all what is available for identifying the system.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .