We're using self-created certificates for an SSTP VPN connection: A 'CA' certificate and, signed with it, customer specific certificates with the customers information: Address etc. However, there seems to be a problem with the certificates on Win 7 machines.

Win 10 works: When importing and connecting with several Windows 10 clients, everything works fine. Connection establishes.

Win 7 doesn't work: Importing on Win 7 works fine (User and Local). But when we try to connect from a Windows 7 Client, we get the following error:

Error 0x800B010F: Certificate CN name does not matched value passed

Edit: We tried from 3 different Win 7 Stations and we got the same error on every machine.

We imported the same CA Certificate on both win 10 and win 7. Details of the certificate match on every machine.

I defined the policies under GPO > Public Key Group Policy > Manage Certificate Path Validation > Stores and enabled trusting Third-Party CAs. Yet it doesn't work on any Win 7 machine. What am I missing?

  • Does this help? blogs.technet.microsoft.com/rrasblog/2009/08/12/… Possible Cause: This issue may occur if the host name of the server that is specified in the VPN connection does not match the subject name that is specified on the SSL certificate that the server submits to the client computer. – Andrew Mar 24 '17 at 16:18
  • We are connecting via IP:Port only. The IP is set in the customers certificate. It works for Win 10, I don't know why it shouldn't for Win 7? We tried a second certificate with a test subject name and added it to the win 7 host file, but that didn't work neither – Sascha Mar 24 '17 at 16:38
  • I'm surprised it's working in win10 to be honest. This seems like it might be a trust issue then. I would suggest trying to add a SAN value to the certificate to include the IP of the VPN server. That might be sufficient for Windows 7. Otherwise, connect using the hostname. – Andrew Mar 24 '17 at 16:41
  • Sorry, I wasn't very clear about our setup: We have a hostname for testing purposes, which doesn't work. And we did set the IP of our VPN Server as a SAN. Neither connecting with hostname, nor connecting with IP does work. – Sascha Mar 24 '17 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.