Security Risk: iOS Remote Desktop Client accepting invalid RD Gateway Certificates
After accidentally importing a wrong certificate (CN mismatch) for our RD Gateway jump host, some mobile users were starting to complain immediately because they were getting certificate warnings. After the first report, I verified using my fully updated iPhone with the latest Microsoft Remote Desktop Client (10.3.6) but did not get any certificate warnings with a pre-configured connection using that RD Gateway. However, when using the Workspace Feed (aka RD WebAccess), there was a certificate warning when refreshing the feed. I then cross checked with the Android RDP Client and it showed the RD Gateway Certificate warning as expected. Well, I was a bit baffled and did some experiments: It seems the iOS RDP Client accepts any certificate without checking, self-signed, wrong CN, ... everything seems to be happily accepted ! I even tested with an old Pad using the abandoned Version 8 iOS client and it had the same issue. I know that Apple users love it if something just works, but in this case this would go way to far 😉 And no - the client did not connect directly to the target RDP server - as in skipping the gateway. That connection would not be possible without gateway and the connection also was confirmed in RD Gateway Monitor. Is it possible that Microsoft has this "feature" in the iOS RDP Client, like forever, and I'm the first to notice?