Trusted certificates for RDS Proxy web targets

Let the browser of web sessions trust self-signed and internal certificates, by public key fingerprint.

Back to the WebView main page

Internal applications often use a self-signed certificate or a certificate of a private authority.
The browser of the bastion refuses them by default, and the user would see an error page.
The list of trusted certificates tells the browser which ones to accept.

Add a certificate

Open RDP Proxy > WebView > Trusted certificates and add the certificate.
Paste it in PEM format, with an optional comment.

Add a trusted certificate

Paste one or several certificates in PEM format.

List of trusted certificates

Each certificate shows its names, its validity, its fingerprint and its comment.

How it works

The bastion keeps the fingerprint of the public key of each certificate (SHA-256 of the SubjectPublicKeyInfo).
It writes the fingerprints to /etc/rdpproxy/webview-trust.json.
Each new web session reads this file and passes the fingerprints to the browser.
A certificate renewed with the same key stays trusted.

Safety rules

A private key pasted by mistake is refused, and nothing is stored or logged.
The trust applies to web sessions only.
The rest of the appliance keeps its own trust store.
Remove a certificate as soon as the application has a certificate of a public authority.

REST API

GET /rdpproxy/webview/trust: the list.
POST /rdpproxy/webview/trust with pem and comment.
POST /rdpproxy/webview/trust/remove with spki.
POST /rdpproxy/webview/trust/comment with spki and comment.