AVD session host is not taking connection and giving certificate error

Hello azadm Ravi Shankar

A “certificate error” when connecting to a newly created Azure Virtual Desktop (AVD) session host can be caused by several factors, including client-side certificate issues, TLS/SSL inspection, session host registration problems, duplicate device registrations, or network connectivity restrictions.

1) Confirm whether it’s a certificate expiration issue on the client side

If the user sees “The certificate in the connection information has expired” (Error code 0x1608), the issue may be related to the Remote Desktop client. Ensure the user is using the latest supported Remote Desktop client and that any cached connection information has been refreshed. Also verify that SSL inspection or security software is not interfering with trusted certificate validation.

2) Check for TLS/SSL inspection or proxy interference

AVD connections can fail when a corporate proxy, secure web gateway, firewall, or endpoint security product performs TLS/SSL inspection and re-signs certificates.

What to check:

• Determine whether the issue occurs only when connecting from the corporate network.
• Ensure TLS/SSL inspection is bypassed for all required Azure Virtual Desktop endpoints.
• Review any security solutions such as Zscaler, Netskope, or similar products that may be inspecting AVD traffic.
• If SSL inspection is occurring on the session host itself, exclude the required AVD traffic from inspection and validate host health afterward.

3) Validate session host availability, health, and registration

If the session host is not properly registered or healthy in Azure Virtual Desktop, users will not be able to connect.

What to verify:

• The session host shows as Running and Available in the host pool.
• The AVD Agent and Boot Loader are healthy and reporting correctly.
• The host registration status is healthy and not stale.
• The user has the required access assignments.
• Host pool RDP properties are configured correctly.

If registration or agent health appears unhealthy, review the session host deployment and registration process and ensure the host is correctly associated with the host pool.

4) Check for duplicate hostname or device registration

For newly created session hosts, connection failures can occur if the VM hostname is already registered to another device within the tenant.

What to verify:

• The session host uses a unique hostname.
• No stale or duplicate device objects exist for the same hostname.
• Microsoft Entra ID registration completed successfully during deployment.

Duplicate device registrations can prevent successful AVD registration and lead to certificate-related connection errors.

5) Review network connectivity requirements

Certificate and TLS-related errors can sometimes be symptoms of network connectivity issues.

What to verify:

• Required Azure Virtual Desktop endpoints are reachable.
• Firewall and proxy configurations allow AVD traffic.
• There are no outbound connectivity restrictions affecting authentication or broker communication.
• Required Microsoft service URLs are not being blocked or filtered. Can you please update us if the action plan provided was helpful? Should there be any follow-up questions or concerns, please let us know and we shall try to address them. If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.