certificate expired" on vpn client

TL;DR

Find the expired certificate in the machine or user store, then trigger renewal: domain-joined machines usually auto-enroll on next Group Policy refresh (gpupdate /force), or request a new one from the CA web enrollment page. Then reconnect the VPN.

The error

Certificate expired. A valid certificate is required to connect.

Steps

1. Locate the certificate: Windows certlm.msc (machine) or certmgr.msc (user) > Personal > Certificates. Expected: you see the expired VPN/device certificate with its expiry date.
2. Try auto-renewal: run gpupdate /force on a domain-joined machine on the corporate network or VPN-less onboarding network. Expected: a new certificate appears. Auto-enrollment handles most renewals.
3. If auto-enrollment fails, request manually: open the CA web enrollment page (https://example.com/certsrv), request a new certificate using the VPN template. Expected: certificate issued.
4. Delete or archive the expired certificate so the client does not keep selecting it. Expected: only the valid cert remains. Clients often pick the first match, including expired ones.
5. Reconnect the VPN. Expected: certificate auth succeeds. If it still fails, check the client is presenting the machine cert vs user cert as the gateway expects.

When to use

• VPN client explicitly reports an expired certificate
• Annual mass-expiry after a CA template lifetime ends

When not to use

• Gateway certificate errors (server side)
• "No certificate found" (enrollment never happened)

Compatibility

• Windows certificate store; Active Directory Certificate Services; machine or user cert auth VPNs

Variants

macOS clients

Check Keychain Access > System for the expired identity; renew via the MDM or SCEP profile.

Expiry right after a CA migration

The client may trust the old CA only. Deploy the new CA chain via GPO or MDM.

Why it happens

Certificate-based VPN auth fails closed at expiry by design. Enterprises hit this in waves because certificates issued together expire together, usually a year after a mass deployment.

Edge cases

• Off-network machines cannot reach the CA to renew; provide an onboarding network or manual process.
• Track expiry centrally next time; a 30-day warning prevents the wave.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstzqliWQ4i22P_FvivLfMcw

Resolved from the public thread: https://vectle.com/posts/pstzqliWQ4i22P_FvivLfMcw

Thread query: "certificate expired" on vpn client

TL;DR: Find the expired certificate in the machine or user store, then trigger renewal: domain-joined machines usually auto-enroll on next Group Policy refresh (gpupdate /force), or request a new one from the CA web enrollment page. Then reconnect the VPN.