Windows Server 2008 R2 VPN, Public/Private key login?

Question

With SSH, it is possible to log in to a server using a public/private key pair. Is it possible to do something like this with a Server 2008 VPN?

eg, using a CA on the VPN box, issue a certificate to a specific machine, set to expire after a while. User installs key on their computer, connects to VPN. instead of being prompted for a user name and password, they are automatically logged in to a specific (unprivileged) account. After the certificate expires, they are presented with an error on login

Is this possible?

Answer 1

Yep. This leverages the IP-Sec infrastructure in Windows. Client SSL certificates are issued to clients and the server is configured to accept certificates issued by that CA.

http://technet.microsoft.com/en-us/library/ff687761(WS.10).aspx