Share via

Always On VPN - User tunnel - IKE failed to find a valid machine certificate

David Spiteri 1 Reputation point
2020-08-19T10:56:14.923+00:00

I have setup an Always on VPN infrastructure (user tunnel), with Windows Server 2019 for VPN and NPS servers. When I try to connect from Windows 10, an error shows: IKE failed to find a valid machine certificate......

Eventviewer on Laptop shows Error code 13806, while CAPI2 logs on RRAS server shows errors on event IDs 11, 41, and 42 (Build chain, Verify Revocation and Reject Revocation Information) for the verification of the VPN server certificate.

Certs (Root and Subordinate) are all installed.

Can someone guide me to check the problem please?

Windows Server Infrastructure
Windows Server Infrastructure
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Infrastructure: A Microsoft solution area focused on providing organizations with a cloud solution that supports their real-world needs and meets evolving regulatory requirements.
518 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gloria Gu 3,891 Reputation points
    2020-08-20T09:41:47.067+00:00

    Hi,

    In regards to your issue, here're my suggestions:

    "Error code 13806" typically occurs when no machine certificate or root machine certificate is present on the VPN server. Please ensure that the certificates outlined in this deployment are installed on both the client computer and the VPN server.

    1. Server Certificate: The IKEv2 certificate on the VPN server must be issued by the organization’s internal private certification authority (CA). It must be installed in the Local Computer/Personal certificate store on the VPN server. The subject name on the certificate must match the FQDN used by VPN clients to connect to the server.
      In addition, the certificate must include the Server Authentication EKU (1.3.6.1.5.5.7.3.1and the IP security IKE intermediate EKU (1.3.6.1.5.5.8.2.2).
      19103-55.png
      19095-56.png
    2. Client Certificate(User Tunnel): If the option to verify the server’s identity by validating the certificate is selected when using PEAP, the client must have the certificates for the root CA and any subordinate CAs installed in its Trusted Root Certification and Intermediate Certificate Authorities certificate stores.
      19096-57.png

    -------If my answer is helpful to you, please remember to mark them as answer. Thank you!------

    Regards
    Gloria

    0 comments
  2. David Spiteri 1 Reputation point
    2020-08-21T06:13:12.22+00:00

    Thanks for your info.....

    The above is all rightly set. Now found out that my laptop is showing CAPI2 errors while trying to validate the CRL of the user tunnel certificate.

    The revocation function was unable to check revocation because the revocation server was offline.

    [ value] 80092013

    Is there a way to solve this from the client side?

    There are no CAPI2 errors on the VPN and NPS servers.

    Thanks again.