1

For a web server, one can purchase a certificate from a CA to provide secure connection (server authentication and data encryption).

But in cases of remote desktop apps like MS Remote Desktop or TeamViewer, how do they establish a secure connection between the remote client and the target PC?

It seems in this case the target PC is a sort of server, so it must have a domain name and a certificate to provide TLS, right? But in most cases it is likely that the target PC does not have a domain name nor a certificate.

Is there any other way to establish a secure connection in this case?

1 Answer 1

1

Details may vary but between setups and products. A common approach is to have a trusted third party (like the product vendor) who mediates the connection. Both endpoints of the remote desktop authenticate themselves against this "master" and also trust this master - and this way the master can mediate a trusted connection between both endpoints. This approach is used in products like TeamViewer, AnyDesk, Google Remote Desktop etc. See also this documentation from TeamViewer. This achieves a similar effect to certificates - establishing a trust relationship with the help of a commonly trusted third party.

MS Remote Desktop is different though. It expects a direct connection, which also means that it is not possible to reach an internal system from outside without port forwarding on the firewall (usually not a good idea, since it provides direct unfiltered access into the internal network) or without having some VPN access to the internal network. And even if the system does not have a public domain name it still can be reached by its IP address. Windows also provides a way to associate a certificate with the RDP server and such certificate can also be used to authenticate only an IP address if this is really all what is available for identifying the system.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .