Как использовать свой сертификат вместо самоподписного для подключения по RDP к машине с Windows 7 (Vista)

How to Force Remote Desktop Services on Windows 7 to 

Use a Custom Server Authentication Certificate for TLS

Server authentication certificates are supported on Windows Vista and Windows 7. To use a custom certificate for RDS, follow the steps below: 

1. Install a server authentication certificate from a certification authority.
2. Create the following registry value containing the certificate’s SHA1 hash to configure this custom certificate to support TLS instead of using the default self-signed certificate.
   
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
   
   Value name:  SSLCertificateSHA1Hash
   Value type:  REG_BINARY
   Value data:  <certificate thumbprint>
   
   The value should be the thumbprint of the certificate separated by comma ‘,’ and no empty spaces. For example, if you were to export that registry key the SSLCertificateSHA1Hash value would look like this:
   
   “SSLCertificateSHA1Hash"=hex:42,49,e1,6e,0a,f0,a0,2e,63,c4,5c,93,fd,52,ad,09,27,82,1b,01
   
   Note: It is necessary to edit the registry directly because there is no user interface on Windows client SKUs to configure a server certificate.
   
3. The Remote Desktop Host Services service runs under the NETWORK SERVICE account. Therefore, it is necessary to set the ACL of the key file used by RDS (referenced by the certificate named in the SSLCertificateSHA1Hash registry value) to include NETWORK SERVICE with "Read" permissions. To modify the permissions follow the steps below:
   Open the Certificates snap-in for the local computer:
   
1. Click Start, click Run, type mmc, and click OK.
   
2. On the File menu, click Add/Remove Snap-in.
   
3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, click Certificates, and click Add.
   
4. In the Certificates snap-in dialog box, click Computer account, and click Next.
   
5. In the Select Computer dialog box, click Local computer: (the computer this console is running on), and clickFinish.
   
6. In the Add or Remove Snap-ins dialog box, click OK.
   
7. In the Certificates snap-in, in the console tree, expand Certificates (Local Computer), expand Personal, and navigate to the SSL certificate that you would like to use.
   
8. Right-click the certificate, select All Tasks, and select Manage Private Keys.
   
9. In the Permissions dialog box, click Add, type NETWORK SERVICE, click OK,  select Read under the Allowcheckbox, then click OK.

Источник: http://support.microsoft.com/kb/2001849