SSTP connection failures on Windows Server 2022 typically stem from incorrect certificate configurations, firewall restrictions on port 443, or NPS policy misalignments. By verifying the Remote Access service status, validating SSL certificates against the server’s FQDN, and ensuring proper routing rules in Network Policy Server, you can resolve most connectivity issues and restore secure VPN access for remote clients.
Verifying Service and Port Availability
The first step in troubleshooting is confirming that the underlying infrastructure is active and accessible. The Secure Sockets Tunneling Protocol (SSTP) relies entirely on HTTPS traffic, which defaults to TCP port 443. If this port is blocked by a hardware firewall or an intermediate proxy, the client will timeout before any authentication attempt occurs. You must ensure that the Windows Firewall on the server allows inbound connections on port 443 specifically for the
RASMAN service. Additionally, verify that the Routing and Remote Access service is running. Open the Services console (
services.msc) and check the status of
Routing and Remote Access. If it is stopped, start it and set the startup type to Automatic. A common pitfall is having the service installed but not enabled for remote access. Right-click the service, select Properties, and click "Configure and Manage Remote Access." Ensure that both LAN and virtual private network (VPN) access are selected. Without this configuration, the server listens for connections but drops them immediately because no policies are assigned to handle the tunnel setup.
Validating Certificate Configuration
Certificate validation is the most frequent cause of SSTP errors. Unlike other VPN protocols, SSTP does not accept self-signed certificates for production environments unless explicitly configured, and even then, trust issues arise. The certificate installed in the Local Computer > Personal store must have the server's Fully Qualified Domain Name (FQDN) as the Subject Name or included in the Subject Alternative Name (SAN) extension. Clients verify this name against the URL they use to connect. If your internal DNS resolves to an IP address but the certificate is issued for a different domain name, the handshake fails silently or with a generic error. Navigate to
Certlm.msc, expand Personal > Certificates, and locate the certificate used by the RRAS service. Check the details tab to confirm the subject matches your external hostname. Furthermore, ensure the private key is present and exportable if needed for backup, though more importantly, verify that the certificate chain is complete. Missing intermediate certificates in the Intermediate Certification Authorities store can cause validation failures on stricter clients. Use the Internet Information Services (IIS) Manager to bind the certificate to the default website or the specific SSTP listener if configured separately. In the RRAS management console, go to IPv4 properties and ensure the correct certificate is selected for SSTP encryption. Mismatched keys or expired certificates will result in Event ID 20228 errors in the System log.
Configuring Network Policy Server
Even with perfect networking and certificates, the Network Policy Server (NPS) must authorize the connection. If no matching network policy exists, the server rejects the request. Open the NPS console and review the Policies > Network Policies section. Create a new policy or modify an existing one to allow SSTP connections. The conditions should include the RADIUS Client IP address range corresponding to your RRAS server. In the Constraints tab, ensure that the Maximum per-user dial-in time is sufficient and that there are no restrictive hour-of-day constraints during testing. Crucially, in the Settings tab, under the Advanced section, verify that the Framed-Protocol is set to PPP and the Framed-Routing is set to Local or LAN. Incorrect framing settings prevent the establishment of the IP layer over the SSTP tunnel. Also, check the Authentication Provider list to ensure it includes Windows Authentication. If you are using RADIUS authentication instead, verify that the shared secret between the RRAS server and the NPS/RADIUS server matches exactly. Case sensitivity matters here. A simple typo in the shared secret will cause authentication failures that appear identical to certificate errors. Review the Event Viewer on the NPS server for detailed rejection reasons, which often specify whether the failure was due to invalid credentials, missing policies, or constraint violations.
Diagnosing Client-Side Errors
Sometimes the issue lies not with the server but with how the client initiates the connection. Windows clients may cache old DNS entries or stale certificate revocation lists (CRL). Clearing the DNS cache with
ipconfig /flushdns can help if the server IP changed recently. For certificate issues, ensure the client trusts the root CA that issued the server certificate. If using a public CA, this is usually automatic, but private CAs require manual installation of the root certificate into the Trusted Root Certification Authorities store on the client machine. Additionally, check the VPN connection properties on the client side. Ensure that the "Use default gateway on remote network" option is checked if you intend to route all traffic through the VPN, as this affects routing tables significantly. If you experience intermittent disconnects, consider adjusting the keep-alive settings. SSTP uses HTTP keep-alives; if a firewall drops idle connections, the tunnel may break. Setting a custom MTU size on the client or server can also mitigate fragmentation issues that lead to dropped packets. Refer to our guide on
Can't Ping AWS Site-to-Site VPN Windows Server Customer Gateway: Troubleshooting Guide for deeper insights into packet flow analysis if basic connectivity tests fail.
Reviewing Logs and Event IDs
When graphical interfaces do not reveal the problem, event logs provide the definitive answer. On the RRAS server, open Event Viewer and navigate to Applications and Services Logs > Microsoft > Windows > RemoteAccess. Look for Event ID 20228, which indicates general connection failures, or Event ID 20229 for user authentication issues. These events often contain hex codes that map directly to specific error states. For example, a hex code indicating an invalid certificate will point you back to the certificate store. Similarly, check the System log for errors related to the
SstpSvc service. If the service crashes repeatedly, enable verbose logging in the RRAS properties under the Security tab. This generates detailed text files in
%SystemRoot%\System32\LogFiles\RemoteAccess. Analyze these logs line by line to trace the handshake process from initiation to termination. Correlate timestamps with client-side attempts to identify patterns. If the logs show successful negotiation but no data transfer, the issue likely resides in routing or firewall state tracking rather than authentication.
Frequently Asked Questions
Why does my SSTP connection succeed but I cannot access the internet?
This usually happens when the "Use default gateway on remote network" option is unchecked on the client VPN profile. Enabling this setting forces all outbound traffic through the tunnel, allowing internet access via the server's connection. Alternatively, check your server's NAT configuration to ensure it is properly translating internal IPs to the public interface.
Can I use a self-signed certificate for SSTP on Windows Server 2022?
Yes, but you must manually install the self-signed certificate's root CA into the Trusted Root store on every connecting client device. Without this trust anchor, clients will reject the certificate due to unverified identity, causing immediate disconnection.
What is the difference between SSTP and L2TP/IPsec regarding port usage?
SSTP operates exclusively over TCP port 443, making it highly compatible with corporate firewalls that block non-web traffic. L2TP/IPsec requires UDP ports 500, 4500, and 1701, which are frequently blocked by strict network security appliances, leading to higher connection failure rates in restricted environments.
How do I reset RRAS configuration if I made multiple errors?
You can remove the Remote Access role via Server Manager and reinstall it, which clears all policies and settings. However, a safer approach is to delete individual network policies and reset the IPv4 routing properties within the RRAS console without removing the entire role, preserving other server configurations.
Does SSTP support split tunneling?
Yes, SSTP supports split tunneling by leaving the "Use default gateway on remote network" checkbox unchecked in the client VPN properties. This allows only traffic destined for the remote subnet to traverse the VPN, while all other traffic uses the local internet connection.