If you are using a self signed certificate on a Windows Server, you may need the certificate bound to the VPN host address itself and one from the server itself that has issued this certificate. I have just set up a SSTP VPN on Windows 2012R2 Essentials and at the client end, I had to do two things:
Install the VPN certificate (e.g. my.vpn.hostname.com) ...
I think you've misunderstood some terms here, copied from your source
An intermediate certificate authority (CA) is an entity that can sign certificates on behalf of the root CA. The root CA signs the intermediate certificate, forming a chain of trust.
The intermediate certificate SIGNS other certificates, it does not provide the encryption ...
Thank you @bjoster. You stimulated some brain cell that caused me to analyze these "identical" servers. Somehow [::]:443 only existed on the server throwing errors.
netsh http delete sslcert ipport=[::]:443 Thank you for your time and inspiration!
This (usually) means, that the endpoint 0.0.0.0:443 on this server uses a certificate that does not (or no longer) exist.
The easiest way to verify this is to go to the IIS Manager and look whether port 443 is still bound to the 'old' SSL certificate.
Or you can do this ("As Administrator") with
netsh http show sslcert
In the output, search for ...