Fix RDGW certificate deployment with proper key permissions

[gpas45]

Summary

This PR fixes a critical issue where the RD Gateway service fails to use newly imported certificates because the NETWORK SERVICE account lacks read permissions on the private key file.

Key Changes

• New Grant-RDGWKeyAccess function: Grants the NETWORK SERVICE account read access to the certificate's private key file. This function handles both RSA-CNG and legacy RSA key storage locations in the Windows crypto key store.
• Explicit certificate import: Added logic to import the PFX certificate into LocalMachine\My before applying it to RD Gateway, with permission setup immediately after import.
• Enhanced error handling:
  • Added -ErrorAction Stop to Set-RDGWCertificate call to ensure errors are properly caught (the cmdlet suppresses errors by default)
  • Added verification that the certificate thumbprint was actually applied to the gateway, catching silent failures
• Improved comments: Added Russian-language explanations of the issues being addressed

Implementation Details

The Grant-RDGWKeyAccess function:

• Extracts the RSA private key from the X509 certificate
• Determines the correct key file path based on whether the key is stored as RSA-CNG or legacy RSA
• Validates the key file exists before attempting to modify permissions
• Adds a FileSystemAccessRule granting Read access to the NETWORK SERVICE account
• Applies the updated ACL to the key file

The main script flow now:

1. Imports the certificate if not already present
2. Grants key access to NETWORK SERVICE
3. Applies the certificate to RD Gateway with proper error handling
4. Verifies the thumbprint was actually applied

https://claude.ai/code/session_01FEgsWVRjt7q8d48YLXZKHY