0

I have installed a wildcard SSL certificate on a Win2022 Server for use for both web (IIS) and VPN authentication. I let Windows choose the appropriate certificate store, but for good measure I installed the certificate also on LocalMachine. Now, Web serving works just fine. However, the certificate does not appear on the Remote Access Server choice and consequently cannot be selected. Worse, the RAS now complains that the default self-signed certificate is not identical to the IIS SSL and refuses to start. My question is: How can I make the new certificate selectable in the RAS configuration page?

Improve this question
8
  • What are the certificate usages?
    – Greg Askew
    Nov 16, 2021 at 15:17
  • Proves your identity to a remote computer/ / Ensures the identity of a remote computer / 2.23.140.1.2.1 It's stored under "trusted root certification authority" (Current User)
    – aag
    Nov 16, 2021 at 15:29
  • 1
    It needs to be in the Personal store and have the Server Authentication Enhanced Key Usage (EKU) (OID 1.3.6.1.5.5.7.3.1) . directaccess.richardhicks.com/2018/07/16/…
    – Greg Askew
    Nov 16, 2021 at 15:41
  • thank you very much for your advice; it's highly appreciated. I have copied the certificate to the Personal Store, and I have added the EKU OID to it and to each certificate in its chain-of-trust. I have then restarted the RAS service. However, I still see only the self-signed cert installed automatically and a "default" which cannot be chosen for some reason (it produces an error). What I am missing? :)
    – aag
    Nov 16, 2021 at 19:25
  • the info box says: [1]Certificate Policy: Policy Identifier=Server Authentication [1,1]Policy Qualifier Info: Policy Qualifier Id=Root Program Flags Qualifier: c0
    – aag
    Nov 16, 2021 at 19:29

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .