Cannot Debug Outdated/Expired Certificate Issue #859

Procreate9318 · 2026-01-16T02:46:07Z

Procreate9318
Jan 16, 2026

I keep getting the Certificate Issue mentioned here despite deleting the relevant (and only certificate) in ~/.config/freerdp/server/

Here is the output when I try testing FreeRDP:

xfreerdp /u:"MyWindowsUser" /p:"[Custom Password Since I am Using FreeRDP 3.20.0]" /v:127.0.0.1 /cert:tofu
[18:29:24:610] [49231:0000c04f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[18:29:24:610] [49231:0000c04f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[18:29:24:610] [49231:0000c04f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[18:29:24:610] [49231:0000c04f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]:   - /args-from: pipe in arguments from stdin, file or file descriptor
[18:29:24:610] [49231:0000c04f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]:   - /from-stdin pass the credential via stdin
[18:29:24:610] [49231:0000c04f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]:   - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[18:29:24:612] [49231:0000c051] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]:     : keycode: 0x08 -> no RDP scancode found
[18:29:24:612] [49231:0000c051] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: ZEHA: keycode: 0x5d -> no RDP scancode found
[18:29:24:623] [49231:0000c051] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x55fa9373a470]: *************************************************
[18:29:24:623] [49231:0000c051] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x55fa9373a470]: This build is using [runtime-check] build options:
[18:29:24:623] [49231:0000c051] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x55fa9373a470]: * 'WITH_VERBOSE_WINPR_ASSERT=ON'
[18:29:24:623] [49231:0000c051] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x55fa9373a470]: *
[18:29:24:624] [49231:0000c051] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x55fa9373a470]: [runtime-check] build options might slow down the application
[18:29:24:624] [49231:0000c051] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x55fa9373a470]: *************************************************
[18:29:24:642] [49231:0000c051] [WARN][com.freerdp.crypto] - [verify_cb]: Certificate verification failure 'self-signed certificate (18)' at stack position 0
[18:29:24:642] [49231:0000c051] [WARN][com.freerdp.crypto] - [verify_cb]: CN = WIN-94QACPGK03R
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [x509_utils_from_pem]: BIO_new failed for certificate
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: @           WARNING: CERTIFICATE NAME MISMATCH!           @
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: The hostname used for this connection (127.0.0.1:3389) 
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: does not match the name given in the certificate:
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: Common Name (CN):
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]:      WIN-94QACPGK03R
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_certificate_name_mismatch_error]: A valid certificate for the wrong name should NOT be trusted!
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: The host key for 127.0.0.1:3389 has changed
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: Someone could be eavesdropping on you right now (man-in-the-middle attack)!
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: It is also possible that a host key has just been changed.
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: The fingerprint for the host key sent by the remote host is 5f:be:bf:9a:02:ad:fc:27:64:14:1a:df:70:00:70:f5:ad:7b:c9:e6:91:6d:8e:fd:28:64:40:07:48:b5:fb:db
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: Please contact your system administrator.
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: Add correct host key in /home/LizardoMoralez/.config/freerdp/server/127.0.0.1_3389.pem to get rid of this message.
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: Host key for 127.0.0.1 has changed and you have requested tofo (auto-accept) checking.
[18:29:24:643] [49231:0000c051] [ERROR][com.freerdp.crypto] - [tls_print_new_certificate_warn]: Host key verification failed.
[18:29:24:643] [49231:0000c051] [INFO][com.freerdp.crypto] - [tls_verify_certificate]: No certificate stored, automatically accepting.
[18:29:24:884] [49231:0000c051] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (host/domain name not found [-1765328143])
[18:29:24:891] [49231:0000c051] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (host/domain name not found [-1765328143])
[18:29:24:893] [49231:0000c051] [ERROR][com.freerdp.core] - [nla_recv_pdu]: ERRCONNECT_LOGON_FAILURE [0x00020014]
[18:29:24:893] [49231:0000c051] [ERROR][com.freerdp.core.rdp] - [rdp_recv_callback_int][0x55fa9373a470]: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[18:29:24:893] [49231:0000c051] [ERROR][com.freerdp.core.rdp] - [rdp_recv_callback_int][0x55fa9373a470]: CONNECTION_STATE_NLA status STATE_RUN_FAILED [-1]
[18:29:24:893] [49231:0000c051] [ERROR][com.freerdp.core.transport] - [transport_check_fds]: transport_check_fds: transport->ReceiveCallback() - STATE_RUN_FAILED [-1]

Here is some more information:
Operating System: OpenSUSE
FreeRDP Version: 3.20.0
Backend Running Windows VM: Docker
In addition, this is coming from my previous attempt installing Winapps, which I never was sure I fully deleted my previous attempt before doing this one. I did not encounter any other noticable errors to my eye up until this point. Can anyone offer assistance?

oskardotglobal · 2026-01-16T10:09:03Z

oskardotglobal
Jan 16, 2026
Maintainer

You can use /cert:ignore instead of /cert:tofu which will completely skip certificate checks.

11 replies

Procreate9318 Jan 30, 2026
Author

Yes, those are the files. I know the documentation can be kind of confusing, we‘re planning to ship a custom docker image which will not have these issues.

So since I kind of hit a dead end (at least to my knowledge), should I just wait for the custom docker image?

oskardotglobal Jan 31, 2026
Maintainer

The custom docker image will not solve anything unless you reinstall your OS (which is something I don‘t know how to fix atm)

oskardotglobal Jan 31, 2026
Maintainer

You could try reinstalling docker though, just back up your VM if you need it

Procreate9318 Jan 31, 2026
Author

I'll try that, though if the entire VM is wonky (I assume that is what you refer to when reinstalling the os), wouldn't I just, let the vm be deleted along with docker's uninstallation? How do I back up a vm?

oskardotglobal Jan 31, 2026
Maintainer

Yeah, you should just delete the VM

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cannot Debug Outdated/Expired Certificate Issue #859

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 11 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Cannot Debug Outdated/Expired Certificate Issue #859

Uh oh!

Uh oh!

Procreate9318 Jan 16, 2026

Replies: 1 comment · 11 replies

Uh oh!

oskardotglobal Jan 16, 2026 Maintainer

Uh oh!

Procreate9318 Jan 30, 2026 Author

Uh oh!

oskardotglobal Jan 31, 2026 Maintainer

Uh oh!

oskardotglobal Jan 31, 2026 Maintainer

Uh oh!

Procreate9318 Jan 31, 2026 Author

Uh oh!

oskardotglobal Jan 31, 2026 Maintainer

Procreate9318
Jan 16, 2026

Replies: 1 comment 11 replies

oskardotglobal
Jan 16, 2026
Maintainer

Procreate9318 Jan 30, 2026
Author

oskardotglobal Jan 31, 2026
Maintainer

oskardotglobal Jan 31, 2026
Maintainer

Procreate9318 Jan 31, 2026
Author

oskardotglobal Jan 31, 2026
Maintainer