Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create a SSTP VPN on my Windows Server 2008 R2, I installed the Network Policies and Access Service, and the AD Certificate Autority service,

I create my root certificate and generated a Server authentication certificate (named with the FQDN of the server), validated it and installed it on the server, I also have installed the CA authority certificate on the client that I need to connect, but when I try to connect, I get this error

Could not build a certificate chain for CA certificate 0 for A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. 0x800b0109 (-2146762487).

( is the (altered) hostname), the certificate is deployed on both the server and the client.. I've searched for hours... and nothing :(

Any idea please ?

Thank you

share|improve this question
up vote 6 down vote accepted

It sounds like you've installed the certificate in the wrong store, you should try manually putting it in Trusted Root Certificate Authorities on the client machine.

Take these steps on the client machine: MMC > Add 'Certificates' snap-in for local computer > Trusted Root Certificate Authorities > Import the certificate here.

share|improve this answer
I've checked this, but its alreary installed, but does the certificate needs to use the used DNS name, or the "real" machine name ? How does the client know what certificate to use ? Because I don't have configured anything to tell the VPN server/client to use this specific certificate – Kedare Sep 26 '10 at 14:53
Oky i've found that I had to define the certificate on the VPN properties, thank you – Kedare Sep 26 '10 at 15:57
also make sure the ssl listener in RRAS is configured to point to the ssl certificate you are wanting to user to secure the VPN – user61623 Nov 26 '10 at 13:41
Make sure to install this certificate on the local computer storage, not for just user session. – eRIZ Aug 28 '15 at 19:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.