How to renew an expired certificate for PCs that must connect via VPN to a server in Azure?

Question

I created my self-signed certificates using PowerShell per https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site#clientexport a year ago and it's time to renew them. I can't even VPN into the Azure cloud I set up any more because the certificates expired today. I get the error, "A certificate could not be found that can be used with this Extensible Authentication Protocol. (Error 798)" on any Windows 10 client machines that try to initiate VPN.

I believe at this point I will have to regenerate all certificates both root and clients, but please advise if there is an easier way to resolve this.

Answer 1

There seems to be no easy way but to start from scratch every time. Although it is best to do this before the certificates expire--if the certificates do expire on you, just follow this same procedure all over again. It is a subset of the steps you would have followed when you first generated your original self-signed certificates (except of course now you are not recreating your virtual network nor recreating your VPN gateway on Azure, etc. Rather, you'll just update the public certificate data for it on step 2 below).

And yes, in the process (steps 1 and 2 below) you will create a new root certificate and have to paste public certificate data up on the Azure portal (https://portal.azure.com). You are allowed to keep several (up to 20) such certificates there, and the purpose of that is to anticipate certificate expirations and prepare your Azure cloud with the next valid certificate before the old one expires.

Aside from the downtime your users will temporarily experience if the certificates do inadvertently expire and you haven't prepared new ones to replace them earlier, you are basically not missing a beat by just following the very same steps below.

NOTE: Any VMs up on the cloud won't necessarily need to have the certificates installed too (unless you're using them there as well for some other purpose requiring encryption). Only the clients will. The Azure point-to-site gateway's certificate data (which handles your VPN connections) is all that needs to be updated up on the cloud per step 2 below. And of course, you've got to update the clients' certificates (step 3).

1. on your administrator's PC--the local, physical computer or server you've chosen to serve as the master location from which you'll create your certificates--regenerate all self-signed certificates (both root and clients, as though starting from scratch--so basically follow all the steps on the link specified for this step here) per https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site
2. paste the root key text onto the Azure portal (portal.azure.com) per the steps titled "Upload the root certificate public certificate data" at https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal#uploadfile. Beware that you will need to remove any expired certificates here prior to saving your newly pasted one or otherwise your save operation on the Azure portal will fail.
3. install the client certificates on all the client PCs per https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert
4. on the Azure portal regenerate the VPN client configuration file per https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-azure-cert and then install it on each client PC

Once you've followed the above steps, your clients should be able to reestablish their VPN connection to your Azure cloud (and get rid of Error 798) and be able to do all their work there as before.

Answer 2

The first answer is so complicated......

To Renew your existing VPN certificate it's not possible.. what you can do is just add new certificate keys to your existing azure VPN configuration

1. First remove the existing root key from azure

2. then run the below PowerShell script on your PowerShell ISE console

   $cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature -Subject "CN=PS2RootCert" -KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 ` -CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign

   New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature -Subject "CN=PS2ChildCert" -KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 -CertStoreLocation "Cert:\CurrentUser\My" -Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")

3. export both root and clild cert keys

4. add root expored key on azure exisitng VPN configuration make sure you removed old one

5. Then install new childcert on UserPC and connect with same old setup