Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to change my TMG server from an old VPN server certificate to a new one due to changing my internal CA structure.

Where the heck do I do that? I don't see any certificate references in TMG nor in the RRAS MMC.

The references I've found on the net to this process have been vague at best.

EDIT - I am using a L2TP / IPSEC VPN.

share|improve this question
up vote 2 down vote accepted

The SSTP VPN service is always associated with a HTTPS web listener; you can change the certificate it uses in its properties.

If you have lots of listeners around and/or don't know what listener the VPN service is using, you can check that in the VPN properties, in the "Protocols" tab.


For L2TP/IPSEC, there is no option in the TMG (or ISA) management console to configure which certificate is used; you just need a valid certificate to be stored in the server's machine certificate store, which can be accessed by using the Certificates MMC.

share|improve this answer
Good comment. I'm using a L2TP / IPSEC VPN. I'll update the question accordingly. – Tim Brigham Feb 13 '12 at 20:17
@Tim: See edit. – Massimo Feb 13 '12 at 20:26
So if I have two valid certificates there is no way to specify which one to use? Wow. – Tim Brigham Feb 13 '12 at 20:29
You can always remove the old one... – Massimo Feb 13 '12 at 20:39
This is all handled at the RRAS/IPSec layer; TMG/ISA doesn't modify certificate selection behaviour from the OS for IP protocols (only Webby ones). – TristanK Feb 13 '12 at 22:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.