Fix: Certificate Validation Failure on VPNs

How to get a VPN certificate?

Open the Microsoft Azure Portal as an admin.
On the left pane, click on Azure Active Directory,
Go to Manage and then click on Security.
Click on the Protect section here and then select Conditional Access.
Now open the Policies page and click on VPN connectivity.
Click on New Certificate here to generate a new certificate for you.

Without Microsoft Azure, it is not possible to create a certificate. And usually, Microsoft Azure requires a subscription as well. But to create a certificate, you can create a trial account with Microsoft temporarily, and before the trial plan expires, you can get the VPN certificate for yourself.

When a VPN certificate expires, you don’t need to create a new one every time. You can simply update the existing one, which will do the job.

How do I fix VPN validation failure?

Check the validity:

Before you get into the solutions, you should check whether the VPN certificate is valid or outdated. If it is obsolete, it does not matter which solution you try. It won’t work. Only an update or renewal of the Certificate will fix the issue.

Press Windows + R key to open the Run dialog box.
Enter “mmc” and press Enter.
Click on File in the left-right corner and select Add/Remove Snap-in.
Select Certificate from the available snap-in section.
Click on the Add button.
Then choose My User Account from the list of options.
This will enable you to see your user certificates in your system. Even your VPN certificate will be present here. To see its details, double-click on it, and it will show you the Certificate’s validity and expiry date.

If the validity is valid for your Certificate, try the solutions mentioned below the next solution to fix it. But if the validity has expired, then try the next solution.

Update your VPN certificate:

Click the Windows Search icon at the bottom left corner and enter certlm.msc.
In the results section, click on the topmost result.
Right-click in the open space of the newly opened window and choose All Tasks.
Select Advanced Operations and choose Create Custom Request.
Click on Proceed without enrollment.
Follow the onscreen instructions and click on the Arrow next to Details.
Then click on Properties from the drop-down menu.
Provide a name as a title to the Certificate and ensure that you remember the name.
Click on Subject and choose a common name from the Ful QDN drop-down menu.
Enter the Full Qualified Domain Name and then click on Add.
Go to next and go back to properties.
Select the Extensions tab.
Select Extended Key Usage.
Go to Server Authentication and choose Add.
Click on the private key tab and choose Cryptographic service provider.
Check either the Microsoft RSA or Microsoft DH option as per your preference.
Save it all by clicking on Apply and then click on Ok.
Click the Windows Search icon at the bottom left corner and enter PowerShell.
Once it appears in the results section, click on it to open it up.
Enter the following command and press Enter.

cd $home\desktop

Enter the next command as mentioned below and press Enter. Remember to replace FILE_NAME with the certificate name that you set previously.

certutil.exe FILE_NAME

Copy all the File’s content and submit and share it to your public certification authority for further signing.
Now validate whether the hostname and host address are still valid or not. If they have expired, you will have to get a new certificate. Or else you can use this mentioned to update the existing one.

Add a VPN certificate:

To add a new VPN certificate to your system, follow the below steps.

Press Windows Key + I to open up Settings.
Click on Network and Internet and then select VPN.
Then click on Add VPN.
A drop-down menu will appear. Choose the option Windows built-in as the VPN provider.
In the connection name field, enter the name you want to set for your VPN connection.
Enter the server name and address as per what you get from the provider and enter it in the Server address field area.
In the Type of sign-in info space, enter the one used by your VPN service provider.
Click on Save.
The name of the VPN will now show up. When this happens, click on it to form the connection.

Turn on OCSP Nonce:

You can also try turning on the OCSP Nonce on your server to fix the certification validation failure issue.

Press the Windows Key and R to open the Run dialog box.
Enter certlm.msc to open the Certificate Service Management Console.
Select the Certificate template from the left menu and select Manage.
From the drop-down menu, choose OCSP Respond Signing.
Right-click on it and then choose Properties.
Go to the security tab from the top and add the server.
Check the box next to Read and Enrol, then return to the Certificate template.
Now click on New and then select Certificate Template to issue.
After this, choose OCSP signing and click on the Certificate server to open its Properties.
Go to the Extension tab and select Authority Information Access.
Enter the URL for the server and then click on Add.
After this, go to the dashboard of the server manager of the OCSP service and select Add Roles and Features.
Check the box Active Directory services and select Role Services.
Uncheck the box for Certificate Authority and check the box for Online Responder.
Open the Online Responder Management console, and that is it. This should fix the certificate validation failure issue.

If the issue still exists, try the solutions mentioned below.

Install a third-party VPN client on your system:

Third-party VPN client services are now fairly simple to install and use in a system. Browsers need an extension to run a VPN client, or the Windows machine can use an entire application to enable its VPN services on the targetted system.

It will be like installing just another application. And once it is done, you just need to open the application file and run the VPN to enable the VPN connection.

Many third-party VPN clients will work excellently, given you are ready to spend some money. The best VPN clients do not provide their service for free, but the investment in network security would be worthwhile in the long run.

If even the third-party application has certification issues or is not working properly, move on to the next solution.

Reinstall the VPN client application:

Reinstalling the VPN client can also iron out any inconsistency that might be present in the Client application. It could be the case that while the application was being installed, one or two important files might have been left out. Or the setup package might itself be corrupt in the first place. As a result, you are bound to face this error. To fix this, first of all, remove this installed software from your PC and then reinstall it from the concerned site.

Regarding the former, you should head over to Control Panel > Add or Remove programs > Select the VPN client application > Uninstall and wait for the process to finish. Once that is done, reinstall it from the official source, which should fix the issue.

If the certificate validation failure still exists, try the next solution

Update the VPN client:

The VPN client you use for your connection might run on an older version. This can be the cause of your validation failure issue as well. So go to the official site of your VPN client and download the latest version setup file or installation file from it. And then install the application on your computer just like any other application. Once this is done, restart the computer and connect to the internet again. Now try setting up the VPN again. If it still shows a certificate validation failure message, move on to the next given solution.

Check your device’s date and time:

If the date and time on your Windows PC are out of sync in real time, that will cause connectivity issues with your network. The VPN certificate validation failure can also arise because these certificates are only valid for a specific timeline. So to fix this, you need to check and ensure that the time and date on your device are correct and accurate as per the actual time. You can do this by pressing Windows Key + I to open Windows Settings and then go to Time & Language. Here, select the time zone as per yoCertificate’sIf this does not solve the certificate validation issue, move on to the next solution.

Update the OS:

Microsoft pushes out updates to Windows regularly to fix its issues. You should also try updating your Windows 10 to the latest version to improve your error.

Press Windows Key + I to open up Windows Settings.
Click on “Update & Security.”
Now, click on the Windows Update tab to see the Windows update option in the right pane.
If you see a pending Windows update, install it on your computer.

Try the following solution if updating Windows 10 to the latest version does not help with the certificate validation failure issue.

Check for firewall or aCertificateterference:

Sometimes, antivirus and firewall programs block out certain system operations suspecting them to threaten the system’s Security. That can lCertificate’several connectivity issues. So it would be best to try turning off your antivirus or firewall to fix this.

To turn off your antivirus or antivirus program, launch it on your computer and find the setting to turn off Real-time protection. Different antivirus or firewall programs have other UI elements. So on your antivirus or firewall program, you must find the setting on your own. Once you find it, disable it and close the antivirus or firewall program.

If this does not even help with the certificate validation failure issue, try the next solution below.

Contact your VPN service provider’s support team:

If none of the solutions mentioned above worked for you, you need to contact the customer support team of the VPN service you use on your Windows computer. They will providCertificatethe appropriate solution to solve your problem.

So these are all the solutions to fix certificate validation failure on VPNs. If you have any questions or queries about this article, comment below, and we will reply. Also, check out our other articles on iPhone tips and tricks, Android tips and tricks, PC tips and tricks, and much more for more helpful information.