Automated SSL certificate renewal for Routing and Remote Access Service (RRAS)

Routing and Remote Access pins the SSTP certificate by hash in the registry. CertKit keeps it current.

The Routing and Remote Access role doesn't reference its SSTP certificate by name, it stores a SHA256 hash of the certificate under HKLM\SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters and binds it through HTTP.SYS. When the certificate renews the hash no longer matches anything in the store, so SstpSvc refuses new SSTP tunnels and existing point-to-point connections fail to re-establish. Every 47 days. On every RRAS server you operate.

CertKit centralizes certificate issuance and renewal, then pushes the renewed certificate to your RRAS servers via the CertKit Agent, updates the SHA256 hash and HTTP.SYS binding, and restarts SstpSvc so the listener comes back on the current certificate.

Start free trial Watch demo

Built for Routing and Remote Access

The pre-built RRAS deployment template ships in your CertKit account. No scripting required.

The CertKit Agent imports the renewed PFX, computes the SHA256 hash RRAS expects, writes it into the SstpSvc parameters, refreshes the HTTP.SYS binding, and restarts the service. No certutil, no hand-edited registry values, no SSTP outage waiting to be discovered.

Restarting SstpSvc drops the SSTP listener for a moment, disconnecting roaming clients and bouncing any SSTP site-to-site link while it comes back. Schedule a deployment window per server so the hash update and restart run at 2am Sunday rather than during business hours. CertKit stages the renewed certificate and only applies it inside the window you choose.

The pre-built RRAS template ships with your CertKit account. Enable it once. CertKit handles every renewal after that.

How to install an SSL certificate for RRAS SSTP

The manual process, if you want to do it yourself:

Get a publicly trusted certificate. It must match the public hostname clients dial. A self-signed or internal CA certificate is why clients throw "a certificate chain processed but terminated in a root certificate" (error 0x800B0109).
Import the PFX into the computer store. Local Machine → Personal on the RRAS server, with the private key.
Update the SSTP certificate binding. In the Routing and Remote Access console, open the server Properties → Security tab and select the new certificate under SSL Certificate Binding. Importing alone changes nothing: SSTP pins the old certificate hash until you rebind.
Restart the service. Restart Routing and Remote Access so SstpSvc picks up the binding and the listener comes back on the new certificate.
Verify. Confirm an SSTP client can connect, then remove the old certificate and repeat on every gateway.

Every one of these steps is manual, and RRAS won't repeat any of them for you when the certificate renews. With lifetimes shrinking to 47 days, installation stops being an annual chore and becomes a recurring task: eight times a year, on every gateway. Miss the rebind and SSTP quietly stops accepting tunnels.

At 47 days, automation is the only sustainable way to run SSTP certificates. Here's how CertKit does it.

How it works

            Your RRAS server
┌──────────────────────────────────────────┐
│  ┌─────────────┐                         │
│  │CertKit Agent│──┐ 1. import PFX        │     CertKit
│  └─────────────┘  │    -> LocalMachine   │   ┌──────────┐
│         │         ▼                      │◄──┤ Issue &  │
│         │   ┌───────────────┐            │   │ Renew    │
│         │   │ Cert store    │            │   │   ┌───┐  │
│         └──►│ SstpSvc params│  2. write  │   └───│DNS│──┘
│   3. bind   │ SHA256 hash   │     hash   │       └───┘
│   HTTP.SYS  └───────┬───────┘            │  one-time CNAME
│         ┌───────────▼───────┐            │  delegated DNS
│         │ SstpSvc restarted │ 4. restart │
│         │ [x] SSTP online   │            │
│         └───────────────────┘            │
└──────────────────────────────────────────┘

CertKit manages issuance and renewal centrally using delegated DNS validation. You create a one-time CNAME record and CertKit handles every ACME challenge after that. The RRAS server never runs an ACME client and never holds DNS credentials, the agent imports the certificate, rewrites the SstpSvc hash, and restarts the service locally.

CertKit is an invaluable tool for administrators managing public TLS certificates in Microsoft environments like Always On VPN (SSTP) and DirectAccess (IP-HTTPS), as it simplifies and fully automates Let's Encrypt certificate issuance and renewal. CertKit eliminates the security risks and complexities of manual DNS challenges or API key exposure.

Richard Hicks, Consultant and Microsoft MVP

What CertKit handles

Issue the public SSTP certificate via ACME, centrally. SSTP needs a publicly trusted certificate matching the gateway's public name so remote clients accept the tunnel. Your RRAS server doesn't need an ACME client, no credentials, and no open ports.
Rewrite the SHA256 hash, not just import the cert. This is the step manual renewals miss. CertKit updates the SstpSvc certificate hash so SSTP actually uses the renewed certificate instead of failing against a stale binding.
Refresh the HTTP.SYS binding and restart SstpSvc. The agent rebinds the SSL certificate in HTTP.SYS and cycles the service so the new tunnel listener comes up clean and point-to-point connections re-establish.
Cover site-to-site and client VPN alike. Whether RRAS is terminating roaming SSTP clients or an SSTP site-to-site link between offices, the certificate dependency is identical, and CertKit keeps both online.
Deploy in a window you control. The SstpSvc restart momentarily drops SSTP tunnels and any site-to-site link, so it shouldn't fire mid-workday. Schedule a deployment window per server and CertKit applies the hash update and restart at 2am Sunday instead of whenever the certificate renews.
Verify the deployment, not just the script. After each renewal, CertKit connects to the SSTP endpoint and confirms the new certificate is being served, checking serial number, SANs, and expiry. A hash that didn't take is caught here, before clients fail to connect.
Alert on failure. Hash-write failures, service restart errors, verification mismatches, and upcoming expirations all generate alerts before they become an outage.
Audit every change. Every issuance, renewal, and hash update is logged with timestamp, certificate, and server. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit. Every renewal challenge after that is automatic.
Install the CertKit Agent on the RRAS server. One command on the Windows Server running the Routing and Remote Access role. The agent runs as a Windows service and needs no inbound firewall rules.
Add the RRAS deployment script. The pre-built template is in your account. Save it and CertKit imports the certificate, rewrites the SSTP hash, and restarts SstpSvc on every renewal.

See the full architecture →

Why importing the certificate isn't enough

With most Windows services, importing a renewed certificate and rebinding by thumbprint is the whole job. RRAS is different because SSTP pins the certificate by a SHA256 hash stored in the registry under SstpSvc\Parameters. Drop a new certificate into the store and SSTP keeps comparing against the old hash, finds no match, and quietly stops accepting tunnels. The certificate is valid and present, the service is running, and SSTP still doesn't work, which makes it a genuinely confusing outage to diagnose.

Scripting around it is fiddly and easy to get wrong: the hash has to be computed in the exact byte format RRAS expects, written to the registry, and matched by a refreshed HTTP.SYS binding before the restart. A typo doesn't error, it just leaves SSTP down.

CertKit issues the SSTP certificate via delegated DNS validation, then the agent handles the hash, the binding, and the restart as one verified step. There is no ACME client on the server and no registry surgery on your renewal calendar.

RRAS is the foundation under Microsoft's VPN roles

The Remote Access role that powers RRAS is the same engine underneath Always On VPN and DirectAccess, each just layers its own configuration and certificate model on top. CertKit automates the public certificate across all three, plus IIS, Exchange, AD FS, and Remote Desktop Gateway, from a single account.

See all integrations

Start automating RRAS certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing