The default certificate used by Remote Desktop is self-signed and triggers a certificate error. For security reasons, use a CA-signed certificate instead. Get a free one-year certificate from Tencent Cloud TrustAsia, then download it. Because Windows can’t recognize this format directly, it needs to be converted to p12 format first. openssl comes bundled with git

1
 openssl pkcs12 -export -clcerts -in [xxx.pem] -inkey [xxx.key] -out [xxx.p12]

Copy the .p12 file to the server, then import it and note down the certificate thumbprint.

You also need to set permissions on the imported private key, adding the Read permission for the NETWORK SERVICE user.

1
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<指纹>" 。

Restart the Remote Desktop service. When you reconnect, you’ll see a lock icon in the connection bar at the top, and there will be no more certificate error.

1
net stop termservice && net start termservice