reasons. In this case, a computer certificate with the Server Authentication purpose contained in the EKU extensions must be installed on the non-domain member VPN server before it can successfully negotiate L2TP/IPsec-based VPN connections with clients. If the non-domain member VPN server is used as an endpoint for a VPN connection with another VPN server, Enhanced Key Usage (EKU) extensions must contain both the Server Authentication and Client Authentication purposes. If you are running an enterprise certification authority (CA) on a computer running Windows Server Certificate Services or Active Directory Certificate Services, you can use the following table to determine the best certificate enrollment method for your requirements. Preferred Alternate Certificate Certificate certificate certificate Object and domain template purposes enrollment enrollment membership method method Request a VPN, Internet certificate by Authentication Service Server Computer Autoenrollment using the (IAS), or NPS server, Authentication Certificates domain member snap-in Request a Server VPN server with certificate by Authentication and connection, Computer Autoenrollment using the Client domain member Certificates Authentication snap-in Request a Client running certificate by Windows Vista or Client Computer Autoenrollment using the Windows XP, domain Authentication Certificates member snap-in Install from a VPN, IAS, or NPS Server CA Web floppy disk or server, non-domain Computer Authentication enrollment tool portable USB member drive Server Install from a VPN server with Authentication and CA Web floppy disk or connection, Computer Client enrollment tool portable USB member Authentication drive Client running Install from a Windows Vista or Client CA Web floppy disk or Computer Windows XP, Authentication enrollment tool portable USB member drive
reasons. In this case, a computer certificate with the Server Authentication purpose contained in the EKU extensions must be installed on the non-domain member VPN server before it can successfully negotiate L2TP/IPsec-based VPN connections with clients. If the non-domain member VPN server is used as an endpoint for a VPN connection with another VPN server, Enhanced Key Usage (EKU) extensions must contain both the Server Authentication and Client Authentication purposes. If you are running an enterprise certification authority (CA) on a computer running Windows Server Certificate Services or Active Directory Certificate Services, you can use the following table to determine the best certificate enrollment method for your requirements. Object and domain membership Certificate template Certificate purposes Preferred certificate enrollment method Alternate certificate enrollment method VPN, Internet Authentication Service (IAS), or NPS server, domain member Computer Server Authentication Autoenrollment Request a certificate by using the Certificates snap-in VPN server with connection, domain member Computer Server Authentication and Client Authentication Autoenrollment Request a certificate by using the Certificates snap-in Client running Windows Vista or Windows XP, domain member Computer Client Authentication Autoenrollment Request a certificate by using the Certificates snap-in VPN, IAS, or NPS server, non-domain member Computer Server Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive VPN server with connection, member Computer Server Authentication and Client Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive Client running Windows Vista or Windows XP, member Computer Client Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive