Microsoft Always-On VPN: IKE failed to find valid machine certificate

Question

I set up an Always-On VPN configuration and I'm testing it - I followed Microsoft's guide at https://learn.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always....

After I got it all set up and I'm at the point where I test the connection by manually creating a connection profile (https://learn.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-de.... under "Manually create a single test VPN connection").

After I click Connect, it's able to reach our network and the VPN server itself, but I get this error: "IKE failed to find a valid machine certificate."

I checked and I have a user authentication certificate for the client computer (which I'm using), I have our CA and Root CA trusted on that client computer, and the VPN server both has the VPN server authentication certificate and the NPS server authentication certificate (the server is both the VPN server and the NPS server).

Not sure why it can't find the VPN server's certificate?

Notes:

• VPN Server & NPS Server are the same system.

Answer 1

Hi ,

I noticed that you said the server is both the VPN server and the NPS server. Did you mean both RAS and NPS services are installed on a single server?

For an object to even talk with your NPS server, it must first be in the RADIUS client list. The RAS with Always-On-VPN has to be as a Radius client and set FQDN and IP address to Friendly server value on the Always-On-VPN server.

As always, we do not recommend to implement the two role VPN and NPS on a single server.

Here is a similar thread discussed before , you could have a look:

Always-On VPN - RAS & NPS services on single server

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,

I'm having the exact same problem.

Followed the config to the T and at the point of testing the VPN connection, I also receive the same error:

IKE failed to find valid machine certificate. Contact your Network Security Administrator about installing a valid certificate in the appropriate Certificate Store.

I have separate RAS and NPS servers.

The point about multi role server doesn't answer the question.

Also, the configuration guide from Microsoft only goes as far as configuring certificates for User Tunneling. So at the point of testing the VPN connection under the sub heading of "Manually create a single test VPN connection" which can be found here:

https://learn.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#configure-the-template-vpn-profile-on-a-domain-joined-client-computer

We haven't even begun to talk about Computer Certificates and Device Tunnels.

Anyone able to help?

Thanks

Answer 3

Why? it's the same issue.

@SethWeber-6088 Did you manage to fix this?

Thanks