Azure Virtual Network Gateway stubbornly keeps cached expired root certificate and won't let me update it.

Question

Azure Virtual Network Gateway stubbornly keeps cached expired root certificate and won't let me update it.

Alejandro Sosa 26

The root certificate for my Point-to-site configuration of the Azure VPN Gateway was about to expire (with the child client certificates I've signed with it already having expired), so I needed to replace it with a new one.

After generating the new cert, with a different CN, and new Key, I deployed it using the Azure portal.

To my surprise, the client (OpenVPN GUI) refused to connect, when I tried my newly generated .ovpn file with the new CA cert (same I just deployed to Azure) and its client certificate (also newly generated and signed with the new root cert).

In troubleshooting, I decided to re-download the configuration file that Azure generates ("Download VPN client"), only to discover that the OLD certificate is still included in it.

Since then I've done everything I can think of, from deleting the old certificate, adding it to the "revoked certificates", even deleting the entire P2S section and reconfiguring it from scratch. The old certificate is still being presented when I try to download teh config file, which makes me think that it is still cached somewhere, and that's why my client can't successfully connect.

I cannot completely delete the VPN Gateway, because the Site-to-site portion is working and being used in a production system (for which I don't control the other end of the tunnel).

Has anyone seein something like this before?

What can I do?

Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-14T18:40:21.6566667+00:00

Hello Alejandro Sosa

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Alejandro Sosa 26 Reputation points

2025-04-14T19:57:00.5866667+00:00

Thanks for your help. I got it to work now.
Apparently it was some backend process that had not synced fully (even though the actual action of saving the settings was showing as complete). I left it alone overnight, and the next morning when I tried, it did respond with the correct certificate (in the downlaoded configuration file) and OpenVPN connected successfully.
Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-14T20:01:53.78+00:00

Hello Alejandro Sosa
Thank you for your response. I have just converted my comment into an answer. Please try to accept it, as it will be useful for other community members to find information faster.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Accepted answer

1 additional answer

Your answer

Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-14T18:40:21.6566667+00:00

Hello Alejandro Sosa

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Alejandro Sosa 26 Reputation points

2025-04-14T19:57:00.5866667+00:00

Thanks for your help. I got it to work now.
Apparently it was some backend process that had not synced fully (even though the actual action of saving the settings was showing as complete). I left it alone overnight, and the next morning when I tried, it did respond with the correct certificate (in the downlaoded configuration file) and OpenVPN connected successfully.
Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-14T20:01:53.78+00:00

Hello Alejandro Sosa
Thank you for your response. I have just converted my comment into an answer. Please try to accept it, as it will be useful for other community members to find information faster.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Answer 1

Hello Alejandro Sosa

I understand that you're encountering an issue while uploading the certificate to the Point-to-Site.

Ensure the new root certificate is correctly uploaded to the Azure VPN Gateway. Double-check the thumbprint of the new root certificate to confirm it matches your expectations.
Make sure the client configuration file (.ovpn) correctly references the new CA certificate and the new client certificate, with accurate paths and names.
When adding the new certificate, first remove the old one before uploading the new root certificate.
In the meantime, please try testing with PowerShell and let me know if you encounter any issues.

kindly check the public document: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps#create-the-vpn-gateway-1

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. User's image

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Praveen Bandaru 2,835 Reputation points Microsoft External Staff

2025-04-14T20:31:43.1866667+00:00

Hello Alejandro Sosa
Thank you for your response. I have just converted my comment into an answer. Please try to accept it, as it will be useful for other community members to find information faster.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Answer 2

Eric Maussion 26

Only coming to relate with OP and tell how unnatural this feels. It's absurd the console states the VPN gateway is updated while it still expects old root certificate(s) to be used.
Even resetting the gateway has zero effect on updating certificates.

Share via

Azure Virtual Network Gateway stubbornly keeps cached expired root certificate and won't let me update it.

1 additional answer

Your answer