Certificates are used throughout the Always On VPN infrastructure so a
discussion about PKI and certificates is critical.
We'll need certificates for a variety of things,
for example,
we'll need to install certificates on the VPN servers and the NPS servers.
And there are a couple of different capabilities that are
enabled when we put certificates there.
We'll also need to issue certificates to our VPN users
to authenticate them on the VPN,
as well as the devices that are performing
device‑based connections or device tunnels,
we'll need to install a certificate on those devices as well.
The VPN server requires a certificate issued by the internal CA for IKEv2.
When running SSTP, it's recommended that a public SSL or TLS certificate be used.
While it is technically possible to use an internal certificate for SSTP,
it should be avoided in most scenarios.
Clients perform revocation checks on the SSTP certificate when they
establish a VPN connection using that protocol.
Most internal CAs or PKIs don't expose their CRL infrastructure publicly,
so that CRL check will fail.
Also,
public CA operators have a much more robust and much more
resilient and higher performing CRL infrastructure,
ensuring reliable operation for your VPN clients using SSTP,
so use a public SSL or TLS certificate for SSTP as much as possible.
Both IKEv2, and SSTP certificates require the server authentication EKU.
The certificate used by IKEv2 however,
requires the IP security like IKE intermediate EKU as well.
Certificates are also issued to NPS servers.
They must include the server authentication EKU.
VPN users will require a certificate with the client
authentication EKU as well as VPN devices.
And certificates for NPS servers, VPN users,
and VPN devices should all be issued by the internal private CA.
An important note here,
ensure that when you're provisioning these certificates for
anything that is a mobile or portable device,
so laptops, and tablets, and so forth,
make sure that those certificates are issued only to
devices with a Trusted Platform Module, or TPM.
Without TPM,
the certificate private keys are simply stored on disk
and protected by NTFS file permissions.
Anyone with administrator privileges can extract those keys.
Storing those keys in the TPM ensures that no one,
including a local administrator, can export those certificates and keys and use them on another endpoint.