Fix VPN Error 13801 on Windows 11/10
This Internet Key Exchange version 2 (IKEv2) error are related to problems with the server authentication certificate. Basically, the machine certificate required for authentication is either invalid or doesn’t exist on your client’s computer, on the server, or both.
IKE authentication credentials are unacceptable
Here’s a quick breakup of the possible causes of Error 13801:
The machine certificate on the RAS server has expiredThe trusted root certificate to validate the RAS server certificate is absent on the clientVPN server name as given on the client doesn’t match the subject name of the server certificateThe machine certificate used for IKEv2 validation on RAS Server does not have “Server Authentication” as the EKU (Enhanced Key Usage).
Since the users do not have any control over the server, there’s very little that can be done to fix this issue. And in most cases, the user might have to the VPN provider’s help desk and get them to repair the error 13801. VPN error 13801 clearly references the protocols being used by the VPN service, so you don’t have to waste time figuring out what IKEv2 for VPN error 1380 is. Look for the correct IKEv2 certificate in the documentation provided by the VPN admin. There are a few ways in which you can confirm this issue: Let’s look at these options in detail:
The certificate does not have the required Enhanced Key Usage (EKU) values assigned
You can check it by the following steps: 1] On the VPN server, run mmc, add snap-in ‘certificates.’ 2] Expand certificates-personal-certificates, double click the certificate installed 3] Click detail for ‘enhanced key usage’, verify if there is ‘server authentication’ below
The machine certificate on the RAS server has expired.
If the issue is caused by this reason, connect the CA administrator and enroll a new certificate that doesn’t expire.
The trusted root for the certificate is not present on the client.
If the client and server are domain members, the root certificate will be installed automatically in ‘trusted root certification authorities.’ You can check if the certificate is present on the client here. Related errors:
VPN Error 789, The L2TP connection attempt failedVPN error 812, Connection prevented because of a policy configured on RAS/VPN serverVPN Error 720, Error connecting to a VPN ConnectionVPN Error 868, Name of the Remote Access Server did not resolveVPN Error 809, Network connection between your computer and the VPN server could not be established.
The subject name of the certificate does not match the remote computer
You can verify using the below steps: 1] On the client, open ‘VPN connection properties’, click ‘General.’ 2] In ‘host name or IP address of destination’ you will need to enter the ‘subject name’ of the certificate used by the VPN server instead of the IP address of the VPN server. Note: The subject name of the server’s certificate is usually configured as the FQDN of the VPN server.
When to call your VPN Server administrator
Having to deal with VPN errors can be extremely frustrating, and when you cannot troubleshoot them independently, the frustration is even more. That’s exactly the case with VPN Error 13801, so waste no time and contact your VPN administrator to make sure the correct certificate is configured on your PC, which is validated by the remote server.
