cpmcgrath's avatar
cpmcgrath
Copper Contributor
Aug 21, 2022
Status:
Closed

Certificates are cached too aggressively in RD Web Client

We use the https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-web-client-admin (Latest version 1.0.27) Normally it works really well, but then once a year we have to update our SSL Certificates.

 

The problem is the Web Client likes to cache the old certificate and not get the latest certificate. This results in people getting the following error:

Hitting F5, Ctrl F5 does not resolve this. The following are the instructions we have to give the AVERAGE USER to get them passed it:

 

* Press F12 to open DEVTOOLS

* Press F1 to open DEVTOOLS SETTINGS

* Under Networking tick Disable Cache (while DevTools is open)

* On the tab, refresh the page with F5.

* Close the DevTools tab

 

Luckily these instructions more or less work for every major browser. But I think you can see that no end user should have to do anything as crazy as this.

 

This also makes the move towards certificates with a shorter life impossible.

 

Can this please be looked into with urgency?

 

(Note: I know this is the Azure Virtual Desktop Feedback, but It's what the feedback button in the web client links to. If there's a better place to provide this feedback please let me know)

13 Comments

  • psmedilink's avatar
    psmedilink
    Copper Contributor

    Why is this idea closed?! It's such a painful experience to have to explain to end users to use dev tools to fix this. 

    • Moonigan's avatar
      Moonigan
      Copper Contributor

      This appears to be fixed in the 2.x release of the client because we had zero issues with it this year.

      • cpmcgrath's avatar
        cpmcgrath
        Copper Contributor

        Unfortunately it's not fixed. We didn't experience it last year, but I believe that was because we upgraded to the v2 client at the same time. This year we already had the latest client, and the error happened. the message has changed though. But exact same behaviour and fix

         

         

         

         

  • We are sorry you are running into issues. To discuss issues we recommend to share your problem on our Tech Community forum (https://aka.ms/wvdtc) or open a support ticket after you have reviewed the troubleshooting options in our documentation (Windows Virtual Desktop troubleshooting overview - Azure | Microsoft Docs)

     

    We recommend to review our troubleshooting section first. The other option you have is to open a support ticket through the Azure Portal.

    • cpmcgrath's avatar
      cpmcgrath
      Copper Contributor

      This is the site that the Webclient gives us to provide feedback. Multiple people have confirmed they experience it. You have a clear explanation of the cause. We shouldn't have to shop around to find the right place to get action on it. 

       

      This is a massive bug that needs to be acted on. Please make sure that the appropriate people internally are notified so it can be treated with the urgency it requires.

  • cpmcgrath's avatar
    cpmcgrath
    Copper Contributor

    Does anyone know if version 2.1.0.0 fixes this?

     

    We'll be updating our certificates soon, so we'll find out.

  • cpmcgrath's avatar
    cpmcgrath
    Copper Contributor

    I would just be careful about extending the lifetime of your certificates beyond a year. Chrome refuses to accept the validity of certificates with a lifetime over 398 days. This only applies to publicly trusted CAs, so maybe that's how you get around it. But personally, I think certificates signed by a publicly trusted CAs should be the expectation.

  • andymensch's avatar
    andymensch
    Copper Contributor

    Hi Chris,

     

    I also just ended up on this post, having the same issue.

    Thanks to your workaround I now have that.

     

    While now every end user needs to do some pseudo-deep-technicians-stuff, I am investing time into excessively https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/change-certificates-expiration-date - to 5 or 10 years.

    I can recommend anyone to do the same.

  • rkapsammer's avatar
    rkapsammer
    Copper Contributor

    That's really a mess from an UX perspective.

     

    And with shorter validity periods of the certficates this is going to be even more of a problem...

  • Moonigan's avatar
    Moonigan
    Copper Contributor

    This is a massive PITA for us for the same reason but your solution is a lot cleaner than what had been previously suggested which involved clearing the local browser cache on the client.