As I’ve discussed previously, it is strongly recommended that the TLS certificate used for SSTP be signed using the Elliptic Curve Digital Signature Algorithm (ECDSA). ECDSA provides better security and performance compared to RSA certificates for Windows 10 Always On VPN connections using SSTP. See my previous post Always On VPN SSL Certificate Requirements for SSTP for more information.
Certificate Signing Request
To generate a Certificate Signing Request (CSR) using ECDSA to send to a public Certification Authority (CA), open the local computer certificate store (certlm.msc) on any Windows server or client and follow the steps below.
- Expand Certificates – Local Computer.
- Right-click the Personal folder and choose All Tasks > Advanced Operations > Create Custom Request.
- Click Next.
- Click Next.
- From the Template drop-down list choose (No template) CNG key.
- Click Next.
- Click Details.
- Click Properties.
- On the General tab enter a name in the Friendly name field.
- Click on the Subject tab.
- In the Subject name section, from the Type drop-down list choose Common name.
- In the Value field enter the VPN server’s public hostname and click Add.
- In the Alternative name section, from the Type drop-down list choose DNS.
- In the Value field enter the VPN server’s public hostname and click Add.
- Click on the Extensions tab.
- Expand Extended Key Usage (application policies).
- Highlight Server Authentication.
- Click Add.
- Click on the Private Key tab.
- Expand Cryptographic Service Provider.
- Uncheck RSA,Microsoft Software Key Storage Provider.
- Check ECDSA_P256,Microsoft Software Key Storage Provider.
- Expand Key options.
- Select the option to Make private key exportable.
- Select the option to Make private key exportable.
- Click Ok.
- Click Next.
- Enter a name for the file in the File Name field.
- Click Finish.
Submit the Request
Once complete, submit the CSR for signing to your favorite public CA. Based on my experience, some CAs are easier to obtain ECDSA-signed certificates than other. Today, Digicert seems to be one of the better public CAs for obtaining EC TLS certificates.
Complete the Request
Once the CA has issued the certificate, import the certificate in to the local computer certificate store on the same client or server where the original CSR was created. The certificate can then be exported and imported on additional VPN servers, if required.
Additional Information
Always On VPN SSL Certificate Requirements for SSTP
Always On VPN Protocol Recommendations for RRAS
Eliminating single points of failure is crucial to ensuring the highest levels of availability for any remote access solution. For Windows 10 Always On VPN deployments, the Windows Server 2016 Routing and Remote Access Service (RRAS) and Network Policy Server (NPS) servers can be load balanced to provide redundancy and high availability within a single datacenter. Additional RRAS and NPS servers can be deployed in another datacenter or in Azure to provide geographic redundancy if one datacenter is unavailable, or to provide access to VPN servers based on the location of the client.
Two more dates for my popular three-day Windows 10 Always On VPN Hands-On Training classes have been added to the schedule for 2018! Classes are now forming in Dallas, October 23-25 and in San Francisco, November 13-15, 2018. These training classes will cover all aspects of designing, implementing, and supporting an Always On VPN solution in the enterprise. The following topics will be covered in detail.
The Windows Server 2016 Routing and Remote Access Service (RRAS) is commonly deployed as a VPN server for Windows 10 Always On VPN deployments. Using RRAS, Always On VPN administrators can take advantage of Microsoft’s proprietary 
DNS server configuration for Windows 10 Always On VPN clients is crucial to ensuring full access to internal resources. For Always On VPN, there are a few different ways to assign a DNS server to VPN clients.
Windows 10 Always On VPN is the replacement for Microsoft’s popular DirectAccess remote access solution. It provides the same seamless, transparent, always on remote connectivity as DirectAccess. Where DirectAccess relied heavily on classic on-premises infrastructure such as Active Directory and Group Policy, Always On VPN is infrastructure independent and is designed to be provisioned and managed using a Mobile Device Management (MDM) platform such as Microsoft Intune.
DirectAccess administrators, and network administrators in general, are likely familiar with the terms “split tunneling” and “force tunneling”. They dictate how traffic is handled when a DirectAccess (or VPN) connection is established by a client. Split tunneling routes only traffic destined for the internal network over the DirectAccess connection; all other traffic is routed directly over the Internet. Force tunneling routes all traffic over the DirectAccess connection.
Internet Key Exchange version 2 (IKEv2) is one of the VPN protocols supported for 
