Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have server running Windows Server 2012 for VPN connections with RRAS. After some initial difficulties with the PKI to get a certificate acceptable for IKEv2, we finally got it working.

It worked for about a week, and now, after we restarted the services for an unrelated issue, it seems the server can no longer find the correct certificate even though it is in the Certificate Manager.

All clients (built-in Windows VPN client) give error

13806: IKE failed to find valid machine certificate. Contact your Network Security Administrator about installing a valid certificate in the appropriate Certificate Store.

The client logs are enormous and hard to make any sense of, but they don't seem to say anything that the error message doesn't.

The certificate that worked before is in the Machine Store on the RRAS server. I checked it again against this detailed survey of what works and what doesn't work and it appears fine. The certificate's CN is set to its internal FQDN, but the Subject Alternative Name: DNS Name is set to the DNS name the VPN clients are using.

Other things I've considered:

  • The certificate doesn't expire until 2015.
  • Both the client and server trust the AD CA's root certificate
  • Using PPTP to the same server works fine
  • Server event logs seem to show nothing
  • Attempting to connect from a computer inside the network also fails with the same error

Is there any way I can force the server to pick the right certificate or at least see why now it refuses the certificate that it accepted earlier?

share|improve this question
The problem ended up being DirectAccess certificates conflicting. The server wanted to use one of the DirectAccess certificates for IKEv2, and it did not have the appropriate settings set. Deleting the DirectAccess certificates caused all kinds of configuration issues, so we reinstalled... I'm leaving the question open because it still applies. Find that it was the DirectAccess was a total guess. I'm hoping somewhere there is a way to generate logs that reveal the certificate issue that I never found. –  0xFE Sep 2 '13 at 4:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.