DirectAccess clients unable to connect after certificate renewal

Question

We've recently renewed the certificate on our DirectAccess server, and since then remote users have been unable to connect.

Looking for the proper troubleshooting process to validate the IP-HTTPS configuration and IPsec tunnels, and isolate where the connection is breaking.

Answer 1

Hello Malzaar,

Thank you for posting in the Microsoft Q&A community.

After renewing the DirectAccess certificate, the most common causes are certificate binding issues, trust problems on the client, or an IP-HTTPS configuration mismatch.  

I would recommend the following troubleshooting steps:  

1. Verify the IP-HTTPS certificate on the DirectAccess server

Run:

Get-RemoteAccess

or check:

Get-DAClientExperienceConfiguration

Confirm that the renewed certificate is selected for IP-HTTPS and that:

• The certificate is not expired.
• The subject/SAN matches the external DirectAccess FQDN.
• The certificate contains the Server Authentication EKU.
• The full certificate chain is trusted by clients.  

2. Validate client connectivity

On an affected client, run:

Get-DAConnectionStatus

and:

Get-NetIPInterface

Check whether the IP-HTTPS tunnel is established successfully.  

3. Review DirectAccess client status information

Run:

Get-DAConnectionStatus

or review the DirectAccess status page in Windows Settings.

If the client reports certificate validation errors, verify that the root and intermediate CA certificates are installed and trusted.  

4. Check IPsec tunnel establishment

On the client:

Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSA

If no Security Associations (SAs) are present, the client may be reaching the server but failing during IPsec authentication.  

5. Review Event Viewer logs

Check both the client and server for relevant errors:

• Applications and Services Logs
  • Microsoft-Windows-RemoteAccess-RemoteAccessServer
    • Microsoft-Windows-DirectAccess-ClientConnectivityAssistant
      • Microsoft-Windows-Iphlpsvc
      • System log
      • Security log (IPsec-related failures)

Look for certificate validation, IP-HTTPS, or IPsec authentication errors.  

6. Verify certificate binding in IIS / HTTP.sys

Confirm the new certificate is correctly bound to the IP-HTTPS listener:

netsh http show sslcert

Sometimes the renewed certificate is installed but the old thumbprint remains bound.  

7. Test external access

From an external network, verify that the DirectAccess FQDN resolves correctly and that TCP 443 is reachable:

Test-NetConnection <DirectAccess_FQDN> -Port 443

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.  

Best regards,
Titus Bui