10

I'm successfully authenticating and connecting to a SSTP VPN (on windows 2008) from my windows 7 machine, but for some reason, the connection is disconnected about a 1-2 seconds after it's established.

I've done the following:

  • Defined a SSTP VPN on my windows server 2008.
  • Defined the same machine as CA.
  • Issued the needed certificates and published them on the client.
  • I'm currently testing this VPN inside my LAN so all the needed ports are opened.

Here are the event log entries when trying to connect:

Error Log (Client):

The user HOME\User dialed a connection named Home VPN which has terminated. The reason code returned on termination is 829.

Error Log (Server-VPN):

The user HOME\User connected on port VPN0-0 on 7/27/2012 at 1:57 AM and disconnected on 7/27/2012 at 1:57 AM. The user was active for 0 minutes 0 seconds. 312 bytes were sent and 4528 bytes were received. The reason for disconnecting was user request.

What would be the issue? How can I resolve or debug it?

UPDATE: I've found an event log (Log=System, Source=RasSstp) message on the windows 7 machine that tries to connect to the VPN:

The SSTP-based VPN connection to the remote access server was terminated because of a security check failure. Security settings on the remote access server do not match settings on this computer. Contact the system administrator of the remote access server and relay the following information:

SHA1 Certificate Hash: 065D681...520375552F

SHA256 Certificate Hash: 18DED363...EEEE28CFD00

2 Answers 2

7

Eventually I found help for this issue here: http://support.microsoft.com/kb/947026 (Internet Archive backup).

I was lucky enough to fit into "Scenario 4".

2
  • 2
    This worked for me! some corrections on solution for Scenerio 4. in the netsh http add sslcert ipport=[::]:443 command, you actually use the SHA1 hash from the clients event log error, not SHA256. But before that, you need to delete the binding with netsh http delete sslcert ipport=[::]:443 Jan 19, 2013 at 4:22
  • 1
    Thanks, worked for me too! To add: the information in the link helped to pinpoint the problem, but I solved it without the registry or the command line. On the VPN/IIS server, opened Server Management, Routing and RRAS, Properties, Tab Security and there at the bottom the SSL certificate binding, just selected the same cert as IIS was using. It even notified me of the SHA mismatch when I first mistakenly selected an incompatible one from the list.
    – M-Peror
    Sep 2, 2014 at 7:11
1

The SSTP-based VPN connection to the remote access server was terminated because of a security check failure sha1 and sha256 are two diferent algorithems with different keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .