Windows Server Routing and Remote Access Service (RRAS) is commonly used for Windows 10 Always On VPN deployments because it is easy to configure and manage, and it includes Microsoft’s proprietary Secure Socket Tunneling Protocol (SSTP). SSTP is a Transport Layer Security (TLS) VPN protocol that is firewall-friendly and ubiquitously available. However, a common configuration mistake can lead to failed connections.
Error 0x80092013
A Windows 10 Always On VPN client may fail to establish a VPN connection to an RRAS VPN server when using SSTP. The VPN client will return the following error message.
“Can’t connect to Always On VPN. The revocation function was unable to check revocation because the revocation server was offline.”
The event log will also include RasClient event ID 20227 with the following error.
“The user [domain\user] dialed a connection named [connection name] which has failed. The error code returned on failure is -2146885613.”
The Win32 error code –2146885613 converts to hexadecimal 0x80092013, which translates to CRYPT_E_REVOCATION_OFFLINE, indicating that the client was unable to successfully perform a check of the VPN server’s SSL certificate.
Revocation Checking
When the VPN client attempts to establish an SSTP connection to the Windows RRAS VPN, it will check the Certification Revocation List (CRL) using the information provided in the SSL certificate. If the CRL is unreachable for any reason, the client will not complete the connection.
Common Cause of Error 0x80092013
Certificate revocation failures for Windows 10 Always On VPN SSTP connections commonly occur when the RRAS VPN server is configured with an SSL certificate issued by an internal certification authority (CA) and the CRL is not publicly available.
Resolving Error 0x80092013
Making the internal CA’s CRL available publicly will of course resolve this error. However, best practice recommendations for the SSTP SSL certificate call for the use of a certificate issued by a public CA. For detailed information about SSL certificate requirements and recommendations, please see Always On VPN SSL Certificate Requirements for SSTP.
Additional Information
Always On VPN SSL Certificate Requirements for SSTP
Gavin Ashton
/ April 2, 2020Interestingly we’re seeing this error on IKE connections. Certs are all valid. VPN server has its private key (Event 70 is informational). We’re getting CAPI2 log event saying the device can’t reach the CRL, which is internal. The VPN server and other ‘internal’ devices can all see the CRL no problem.
Richard M. Hicks
/ April 2, 2020Odd for sure. :/
James Marple
/ February 27, 2024Hi, did you ever resolve this? We’re seeing exactly the same issue….