RDP warning "The identity of the remote computer cannot be verified" explained

The first time you connect to your server, Remote Desktop shows a yellow warning: The identity of the remote computer cannot be verified. It looks alarming, but on a new server it is normal. This guide explains what the warning means, how to confirm you are talking to your own server, and which situations deserve a closer look.

Before you start

• A Windows VPS or Admin RDP server, and its IP address from your VPS provider's control panel.
• A Remote Desktop app: mstsc on Windows, or Windows App on macOS, iPhone, iPad or Android.
• Access to the browser console in your VPS provider's control panel, if you want to check the certificate from the server side.

Why the warning appears

Remote Desktop encrypts the connection with TLS, the same technology used by HTTPS websites. To do that, the server presents a certificate. Windows creates a self-signed certificate for Remote Desktop automatically, named after the computer.

Your PC cannot verify that certificate for two reasons:

• It is not signed by a trusted certificate authority. No outside party has vouched for it.
• The name does not match. You connected to 203.0.113.10:3389, but the certificate carries the server's computer name, such as WIN-ABC123.

The connection is still encrypted. The warning only says your PC cannot prove which machine is on the other end.

Check the certificate before you trust it

For most people, connecting to an IP you just copied from your own Dashboard is enough. If you want to be thorough, compare the certificate thumbprint on both ends.

On your PC

1. In the warning, click View certificate.
2. Open the Details tab and scroll to Thumbprint.
3. Note the long hexadecimal string.

In Windows App on a Mac or phone, choose Show Certificate in the prompt to see the same details.

On the server

Open the browser console from your VPS provider's control panel, sign in, and run this in PowerShell:

Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'" |
  Select-Object SSLCertificateSHA1Hash

This shows the thumbprint of the certificate Remote Desktop is using. You can also list the certificate itself:

Get-ChildItem 'Cert:\LocalMachine\Remote Desktop' | Format-List Subject, Thumbprint, NotAfter

If the thumbprint matches what your PC showed, you are connected to your own server.

Trust it once

When you are satisfied:

• Windows (mstsc): tick Don't ask me again for connections to this computer, then click Yes. Windows remembers the thumbprint for that address.
• Windows App (Mac, iOS, Android): click Continue. Some versions offer an option to always trust the certificate for this PC.

From then on, the warning only returns if the certificate changes.

When the warning is a red flag

The warning is normal on a first connection. Take a closer look when:

• It appears again for a server you already trusted, and you have not reinstalled the OS, renamed the server or changed its certificate. Check the thumbprint on the server before entering your password.
• You are on public or hotel Wi-Fi and the warning appears unexpectedly. A network that intercepts traffic could present its own certificate.
• The certificate name is strange, for example a name that is not your server's and that you do not recognise.

Windows renews the self-signed Remote Desktop certificate on its own from time to time, and a reinstall from your VPS provider's control panel creates a new one. In those cases a fresh warning is expected. Verify the thumbprint once and trust it again.

Get rid of the warning for good

To stop the warning entirely, install a certificate from a trusted authority for a hostname such as rdp.example.com, then connect by that name. This takes more setup and needs renewing, so it suits teams and long-lived servers more than a single user.

Check it works

1. Connect to 203.0.113.10:3389 and trust the certificate after checking it.
2. Disconnect and connect again.
3. You should go straight to the login prompt without the identity warning.

Troubleshooting

• Warning appears every time even with the box ticked: you may connect by different addresses (IP one day, name the next). Use one address. Saved entries are kept in the registry key HKCU\Software\Microsoft\Terminal Server Client\Servers.
• "The certificate has expired": the server is presenting an old certificate. See Fix the RDP certificate expired error.
• No checkbox to remember the choice: a policy on your PC may block it. Ask your IT team, or connect from a personal device.
• Warning after an OS reinstall: expected. The reinstall created a new certificate, so check and trust it again.

Next steps

• Replace the self-signed certificate: Install a trusted TLS certificate for Remote Desktop.
• Use a name instead of an IP: Connect to Remote Desktop with a domain name.
• Harden the rest of your setup: Secure Remote Desktop on Windows Server.