I'm setting up my first RD Services deployment, and I have a question about Remote (Internet) connections to the Gateway.
I have a certificate from a major CA for my external domain name which authenticates the Gateway without issue, but the connection then hops to the endpoint [workstation/RD Session Host] which presents a self-signed certificate and thus a warning is issued about the untrusted certificate.
What is the correct answer here? I can't obtain a major CA alternate name for each end-point that remote user's PCs will trust, and I'd rather not have to install certificates on their home PCs.
Is the Gateway actually authenticating the endpoint's cert and passing the warning to the end user, or is the end user's PC actually authenticating both the gateway and the endpoint PC?
What certificate setup should I use here?