# L2TP protocol computer certificate - what? **URL:** \ **Category:** Factual Questions\ **Created:** [December 11, 2008, 11:44pm UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793 "2008-12-11T23:44:39Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 11, 2008, 11:44pm UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/1 "2008-12-11T23:44:39Z")
I am running Win XP PRO SP2 and in the event log I find a warning > [@](#): > > Event: 20192 > Source: Remote Access > > A certificate could not be found. Connections that use the L2TP protocol over IPSec require the installation of a machine certificate, also known as a computer certificate. No L2TP calls will be accepted. > > Explanation > This computer cannot accept Layer Two Tunneling Protocol (L2TP) virtual private network (VPN) calls because it does not have an L2TP computer certificate installed. > > User Action > Install a computer certificate for L2TP VPN connections on this computer. I have no idea what this is but I need to be sure it is not someone trying to connect to my computer from outside. I think chances are this is benign but I want to be sure. Could it be the router just trying to set up something? Could this be internal to my computer? What are the calls not being accepted? Should I install a certificate? How would I do that? Why would I need it? For VPN? I need to know more about this. ---
**Author:** ![Caldazar](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Caldazar](https://boards.straightdope.com/u/Caldazar)\ **Post date:** [December 12, 2008, 1:12am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/2 "2008-12-12T01:12:38Z")
> [@sailor](#): > > I am running Win XP PRO SP2 and in the event log I find a warning > I have no idea what this is but I need to be sure it is not someone trying to connect to my computer from outside. I think chances are this is benign but I want to be sure. > > Could it be the router just trying to set up something? Could this be internal to my computer? What are the calls not being accepted? > > Should I install a certificate? How would I do that? Why would I need it? For VPN? > > I need to know more about this. It sounds like you’ve configured your workstation to accept incoming connections. Assuming you’ve configured it correctly, (and it sounds like you haven’t) it allows remote machines to initiate a direct connection to your machine. You can check for Incoming connections at Start –\> Settings –\> Network Connections. Unless you’ve intentionally configured your workstation to be a remote access server/endpoint, you should probably delete the connection(s) for security reasons. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 12, 2008, 1:43am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/3 "2008-12-12T01:43:30Z")
Yes, I want to be able to connect remotely using the remote desktop and/or VPN. That is intended. But I do not understand the rest. ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [December 12, 2008, 9:11am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/4 "2008-12-12T09:11:05Z")
IPSec is a standard for the encryption of TCP packets. This relies on a _Computer Certificate_ - a piece of data that contains a unique identifier for a computer, that is exchanged securely as part of the negotiation to set up L2TP VPNs (Layer 2 Tunnelling occurs at the ethernet level - layer 2 of the OSI stack, as opposed to Point-to-Point Tunnelling, which is a higher level protocol). Now, in a corporate environment you use a Public Key Infrastructure system to generate certificates - you install a certificate for the Certificate Authority (CA) and a computer certificate generated by that CA, and thus your computer will trust any certs generated by the CA, and your computer certificate will trust and certs from the CA. For a couple of stand-alone machines, it seems to be a bit unclear. You may need to obtain a certificate for each machine from a Certificate Authority, then install both the CA certificate and the appropriate Computer certificate on each machine. [CACert.org](http://CACert.org) lets you sign up and generate Client certificates for free, and supply the appropriate Root CA certificate to import. To be honest, for what you want to do, this seems like a real hassle. This is a case of the MS solution being geared to a corporate infrastructure, and being unnecessarily complex for a small system setup. Si ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 12, 2008, 10:52am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/5 "2008-12-12T10:52:05Z")
Thanks for that info **si\_blakely**. I have looked into this a bit further. It seems the errors in the log appear every time I start the computer so it seems it is not someone trying to break in but rather the computer trying to set up that service and then informing it failed and that service will not work. I am not sure exactly for what it is needed but I’d like to get it to work in case I find out I need it for VPN or something else. I found [Administrator's Guide to Microsoft L2TP/IPSec VPN Client | Microsoft Learn](http://technet.microsoft.com/en-us/library/bb742553.aspx) which seems to deal with this quite in depth - - which means I don’t understand most of it. > [@](#): > > [Administrator's Guide to Microsoft L2TP/IPSec VPN Client | Microsoft Learn](http://technet.microsoft.com/en-us/library/bb742553.aspx) > > **Microsoft L2TP/IPSec VPN Client supports the use of either certificates or pre-shared keys for IPSec authentication.** > > - **Microsoft L2TP/IPSec VPN Client and certificates** > > - > - Advantages and disadvantages of certificates > > - > - Obtaining certificates > > - > - Certificates on the VPN server > > - \*\*Microsoft L2TP/IPSec VPN Client and pre-shared keys \*\* > A pre-shared key is a sequence of characters used to authenticate the IPSec portion of the L2TP/IPSec connection. Both the VPN client and VPN server must be configured to use the same case-sensitive string of characters in order for successful IPSec authentication. > > Microsoft L2TP/IPSec VPN Client can be configured to use pre-shared key authentication with a keyboard character-based pre-shared key using the Microsoft IPSec VPN Configuration Utility. > > - > - Advantages and disadvantages of pre-shared keys > The advantage to pre-shared key authentication is that it does not require investment in a PKI, which is necessary for using certificates for L2TP/IPSec authentication. Pre-shared keys are easy to configure on a remote access client. > > The following are disadvantages to using pre-shared key authentication: \ > > - > - Considerations when choosing a pre-shared key > The pre-shared key for Microsoft L2TP/IPSec VPN Client can be any string of any combination of keyboard characters from 8 to 255 characters long. \ > The Microsoft IPSec VPN Configuration Utility allows you to paste a character string for the pre-shared key. So my next step is going to be to try to set up L2TP/IPSec to work with shared key rather than with certificate. Any help is welcome because I am totally lost. I am looking into [http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q240262](http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q240262) although it says it is for Win 2000. > [@](#): > > The Microsoft L2TP/IPSec VPN Client is downloadable, distributable client software available at [http://download.microsoft.com/download/win98/Install/1.0/W9XNT4Me/EN-US/msl2tp.exe](http://download.microsoft.com/download/win98/Install/1.0/W9XNT4Me/EN-US/msl2tp.exe). I wonder if I may have to install this on my laptop. But I’ll cross that bridge later. ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [December 12, 2008, 11:14am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/6 "2008-12-12T11:14:15Z")
> [@sailor](#): > > So my next step is going to be to try to set up L2TP/IPSec to work with shared key rather than with certificate. Any help is welcome because I am totally lost. I think that this is the least complex approach, but the instructions are not very clear. However, I think this involves playing with Security Policies - I try to leave that to the AD gurus. > [@sailor](#): > > I am looking into [http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q240262](http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q240262) although it says it is for Win 2000. Win 2000 does not have the same set of Security Policies as XP/2003/Vista, thus the special procedure. You can set the connecting system easily enough (there is a pre-shared key checkbox), but the issue is the RRas server. You should be able to set the configuration via the RRas mmc snapin, or maybe the SecPol mmc snapin, but it does not seem to be obvious. Sorry that I can’t be more helpful, but this is not something I would normally attempt and I don’t have access to a system I can play with - I prefer using OpenVPN. > [@sailor](#): > > I wonder if I may have to install this on my laptop. But I’ll cross that bridge later. You only need that on systems that don’t have a built in IPSec/L2PT client - XP machines should be fine (if not, apply at least SP2). Si ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 12, 2008, 11:17am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/7 "2008-12-12T11:17:58Z")
I am looking into [Microsoft Support](http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q240262) although it says it is for Win 2000. I could not find specific for Win XP PRO SP2 which is what I have. It gives the steps to follow in order to use pre-shared keys. Adding the value - HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters\ProhibitIpSec to the registry has stopped the error from showing at startup (I think). From the name of the key, ProhibitIpSec, it sounds like it just disables IpSec but IpSec service is running OK. The second part (How to create an IPSec policy for use with L2TP/IPSec Connections by using a preshared key) i do not understand and does not seem to match anything in my system. It may be because it is for domains and.or for win2000. Any ideas? ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [December 12, 2008, 11:37am UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/8 "2008-12-12T11:37:34Z")
> [@sailor](#): > > The second part (How to create an IPSec policy for use with L2TP/IPSec Connections by using a preshared key) i do not understand and does not seem to match anything in my system. It may be because it is for domains and.or for win2000. > > Any ideas? OK. Launch the **Local Security** mmc snapin (Control Panel, Administrative Tools, Local Security). Select **IP Security Policies on Local Computer** , then double click **Secure Server**. You will see the rules. Select the **Secure Server** rule, and click the **Edit…** button. Click the _Authentication Methods_ tab, and fill in the details for the Pre-shared key. I think that this will work, but YMMV. You may need to do the same for the Server rule as well, but try just the Secure Server rule first. Good luck Si ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 12, 2008, 5:25pm UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/9 "2008-12-12T17:25:35Z")
Thanks **si\_blakely** , I would never have been able to find it if you hadn’t told me. I have spent a couple of hours investigating and tinkering with all the security settings but I am still quite lost. And I can’t really test anything because I would need to have a second internet connection to see if I could connect to this computer from another computer. Still, just by looking around I am learning where some things are and what to look for. I have set a shared key at Control Panel - Administrative tools - Local Security Policy - IP Security Policies on Local Computer - Secure server - Rules - Edit - Authentication Methods - Add - Use this preshared key but, as I said, I cannot test it yet. Still, if I remove the HKEY\_LOCAL\_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters\ProhibitIpSec key I still get the error in the event log. > [@](#): > > A certificate could not be found. Connections that use the L2TP protocol over IPSec require the installation of a machine certificate, also known as a computer certificate. No L2TP calls will be accepted. Whether there is a shared key or not makes no difference, only whether there is that key in the register. I am lost. I think the error message should say “Connections that use the L2TP protocol over IPSec require the installation of a machine certificate **or a shared key** ”. It seems IpSec may only work with certificates and not with shared keys. I have been reading a bit about Kerberos and I think I undertand the need for certificates and an issuing authority like Verisign in that the issuing authority is involved, not just is issuing the certificates, but in every comunication. Also a search gives me that ProhibitIpSec = 1 means L2TP works but without encryption (no IpSec) so that is not really the answer. I wonder if it may be worth while looking for certificates. Anyway, I continue to fumble around in the dark… ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [December 12, 2008, 5:46pm UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/10 "2008-12-12T17:46:33Z")
> [@sailor](#): > > I have been reading a bit about Kerberos and I think I undertand the need for certificates and an issuing authority like Verisign in that the issuing authority is involved, not just is issuing the certificates, but in every comunication. The issuing authority is not actually involved during the communication process. The CA issues an authorising certificate, installed into the Root Certificate store. By referring to this certificate, the authenticity of the client certificates can be verified. So there is no communication with the issuing authority during authentication, but the valid Root certificate is required. As I say, I have never tried to use IPSec/L2TP on XP systems, so I probably will be not much further help. Si ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 12, 2008, 7:46pm UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/11 "2008-12-12T19:46:56Z")
Thaks for your help. I found in IE6 - Tools - Internet Options - Content - Certificates a certificate issued to: sailor issued by: sailor I have no idea how this was created but it seems my own machine can create its own certificates and I can have it be a trusted issuer. The problem is that I still cannot see how I can get IpSec to see it and use it. I will continue to waste time on this. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [December 14, 2008, 5:25pm UTC](https://boards.straightdope.com/t/l2tp-protocol-computer-certificate-what/476793/12 "2008-12-14T17:25:50Z")
Well, I am still tinkering with this. I got a certificate from [www.thawte.com](http://www.thawte.com) but I cannot get it to work. Maybe it is that “Root certificate” missing or something. I don’t know. The way I understand it now is that VPN can go over PPTP, which does not require certificates, or over L2TP/IPSec, which does require certificates and, for this reason, is more secure. I guess for now I’m stuck with using VPN over PPTP until I can get L2TP/IPSec to work. If anyone has any ideas I’d like to hear them.