Certificates are cached too aggressively in RD Web Client
We use the https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-web-client-admin (Latest version 1.0.27) Normally it works really well, but then once a year we have to update our SSL Certificates.
The problem is the Web Client likes to cache the old certificate and not get the latest certificate. This results in people getting the following error:
Hitting F5, Ctrl F5 does not resolve this. The following are the instructions we have to give the AVERAGE USER to get them passed it:
* Press F12 to open DEVTOOLS
* Press F1 to open DEVTOOLS SETTINGS
* Under Networking tick Disable Cache (while DevTools is open)
* On the tab, refresh the page with F5.
* Close the DevTools tab
Luckily these instructions more or less work for every major browser. But I think you can see that no end user should have to do anything as crazy as this.
This also makes the move towards certificates with a shorter life impossible.
Can this please be looked into with urgency?
(Note: I know this is the Azure Virtual Desktop Feedback, but It's what the feedback button in the web client links to. If there's a better place to provide this feedback please let me know)
13 Comments
- psmedilinkCopper Contributor
Why is this idea closed?! It's such a painful experience to have to explain to end users to use dev tools to fix this.
- MooniganCopper Contributor
This appears to be fixed in the 2.x release of the client because we had zero issues with it this year.
- cpmcgrathCopper Contributor
Unfortunately it's not fixed. We didn't experience it last year, but I believe that was because we upgraded to the v2 client at the same time. This year we already had the latest client, and the error happened. the message has changed though. But exact same behaviour and fix
- TaniaMariscal
Microsoft
Status changed:NewtoClosed- cpmcgrathCopper Contributor
Can this please be re-opened?
- TaniaMariscal
Microsoft
We are sorry you are running into issues. To discuss issues we recommend to share your problem on our Tech Community forum (https://aka.ms/wvdtc) or open a support ticket after you have reviewed the troubleshooting options in our documentation (Windows Virtual Desktop troubleshooting overview - Azure | Microsoft Docs)
We recommend to review our troubleshooting section first. The other option you have is to open a support ticket through the Azure Portal.
- cpmcgrathCopper Contributor
This is the site that the Webclient gives us to provide feedback. Multiple people have confirmed they experience it. You have a clear explanation of the cause. We shouldn't have to shop around to find the right place to get action on it.
This is a massive bug that needs to be acted on. Please make sure that the appropriate people internally are notified so it can be treated with the urgency it requires.
- cpmcgrathCopper Contributor
Does anyone know if version 2.1.0.0 fixes this?
We'll be updating our certificates soon, so we'll find out.
- cpmcgrathCopper Contributor
I would just be careful about extending the lifetime of your certificates beyond a year. Chrome refuses to accept the validity of certificates with a lifetime over 398 days. This only applies to publicly trusted CAs, so maybe that's how you get around it. But personally, I think certificates signed by a publicly trusted CAs should be the expectation.
- andymenschCopper Contributor
Hi Chris,
I also just ended up on this post, having the same issue.
Thanks to your workaround I now have that.
While now every end user needs to do some pseudo-deep-technicians-stuff, I am investing time into excessively https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/change-certificates-expiration-date - to 5 or 10 years.
I can recommend anyone to do the same.
- rkapsammerCopper Contributor
That's really a mess from an UX perspective.
And with shorter validity periods of the certficates this is going to be even more of a problem...
- DanHagermanCopper Contributor
I agree, this is also an issue for us.
- MooniganCopper Contributor
This is a massive PITA for us for the same reason but your solution is a lot cleaner than what had been previously suggested which involved clearing the local browser cache on the client.