Symptoms
Microsoft Windows may fail to establish a DTLS connection if the certificate key for the SHA-2 algorithm (SHA-256, SHA-384, and SHA-512) is not available for 'Microsoft Enhanced RSA and AES Cryptographic Provider'.
Impact
VPN connection on Windows may fail to establish DTLS 1.2 connection and fallback to TLS (establish VPN connection using TLS).
Conditions
-- APM Network Access resource configured with DTLS.
-- DTLS v1.2 virtual server configured with client certificate 'request' or 'required' option.
Workaround
1. Import the client certificate key into 'Microsoft Enhanced RSA and AES Cryptographic Provider'.
2. When creating certificate packages, explicitly specify the crypto provider: Microsoft Enhanced RSA and AES Cryptographic Provider. For example use -CSP argument with OpenSSL command:
openssl pkcs12 -export -in client_auth.crt -inkey client_auth.key -out client_auth_2.pkcs12 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider"
