What Is The Best Way To Secure Terminal Services?

What is the best way to secure RDP on the server.

Buy a certificate?, not really sure how that works, i have heard of 2X client, is that used for RDP, or other ways?

Thanks