How to sign a .rdp file, when the certificate in in azure key vault HSM, and after sign how to verify that it signed

hi Prashant! thanks for posting this question,

u gotta use azure key vault's 'sign' operation directly. since u can't export the private key (yes, hsm protects it, good security move!), traditional tools like rdpsign won't work here. instead, u need to manually craft the signature block in the .rdp file. hash the .rdp file content (u already did this with get filehash, good!) use az keyvault key sign to get the signature blob (u got this far too, nice!) now the sneaky part, u need to format the signature correctly for .rdp files. it expects a specific base64 encoded structure

$signature = [convert]::tobase64string($azSig.blob)
add content 'signature:s:'$signature to your .rdp file 

as for verification... thats where it gets funky )) since u dont have the cert locally, u'll need to

extract the signature from the .rdp file, get the public key from azure key vault. verify the hash matches using az keyvault key verify.

worth noting that some rdp clients might still complain without seeing the full cert chain. microsoft's remote desktop client can be picky about this sometimes. when dealing with hsm stored certs, always remember u can't export private keys (that's the whole point!). signing operations must happen inside the hsm. verification needs the public key only (which u can export)

this might help in other tools too - many apps struggle with hsm backed certs. the pattern is usually, generate hash locally, send to hsm for signing, insert signature manually

check if your rdp client supports alternative signature verification methods. some can be configured to trust your key vault's public key directly.

microsoft actually has a great article about working with hsm backed certs https://docs.microsoft.com/azure/key-vault/certificates/about-certificates

let me know if my notes help u or non

rgds,

Alex