Automatically Grant NETWORK SERVICE Read Access to SSL Certificate Private Keys

Good Morning,

TSplus Remote Access allows administrators to import third-party SSL certificates in PFX format through the built-in certificate management module.

We have identified an issue affecting some customer installations following the import or renewal of an SSL certificate.

In certain environments, users are unable to establish HTML5 or RDP sessions after the new certificate has been deployed.

Our investigations revealed that, on the affected servers, the NETWORK SERVICE account (NT AUTHORITY\NETWORK SERVICE) does not have Read permission on the private key of the imported certificate in the Windows Certificate Store (Local Computer > Personal > Certificates).

This issue can result in Windows SCHANNEL errors, including:

• Event ID: 36870

• Error code: 0x8009030D

• Affected service: TermService (Remote Desktop Services)

Microsoft documents similar issues involving insufficient permissions to access certificate private keys.

Proposed Enhancement

We suggest enhancing the third-party SSL certificate import process in TSplus Remote Access to:

1. Check whether the imported certificate has an associated private key.

2. Verify whether the NETWORK SERVICE account has Read permission on that private key.

3. Automatically grant the required Read permission if it is missing, without modifying existing permissions.

This would help prevent RDP connection failures following SSL certificate imports or renewals, particularly in environments where the imported certificate is also used by Windows Remote Desktop Services.

We have confirmed this behavior during troubleshooting sessions with affected customers.

Please let us know if you need any additional technical information or diagnostic data.

Best regards,
Olivier