# How to Configure Point-to-Site VPN in Microsoft Azure using Certificate Authentication
As remote work becomes standard, organizations must provide secure access to internal resources hosted in the cloud. Exposing virtual machines or databases directly to the public internet via Public IP addresses is a severe security risk.
A Virtual Private Network (VPN) solves this by creating an encrypted tunnel over the internet. In Microsoft Azure, a **Point-to-Site (P2S) VPN** allows individual client computers (Windows, macOS, or Linux) to securely connect to an Azure Virtual Network (VNet) from any location.
This guide details the complete technical workflow for configuring an Azure P2S VPN utilizing native Azure Certificate Authentication.
## Architecture Overview
To implement a P2S VPN in Azure, you must deploy the following resources:
1. **Virtual Network (VNet):** The private network hosting your Azure resources.
2. **GatewaySubnet:** A dedicated subnet exclusively used by the VPN Gateway.
3. **Virtual Network Gateway:** The Azure appliance that handles the routing and encryption of the VPN tunnels.
4. **Certificates:** A Root Certificate installed on the Gateway, and Client Certificates installed on the remote computers.
## Step 1: Create the Virtual Network and Gateway Subnet
Before creating the VPN Gateway, the underlying network infrastructure must be in place.
1. Log in to the **Azure Portal**.
2. Search for and select **Virtual Networks**.
3. Click **+ Create**.
4. Define the **Resource Group**, a **Name** (e.g., `Corporate-VNet`), and select a **Region**.
5. On the **IP Addresses** tab, define the overarching IPv4 address space (e.g., `10.1.0.0/16`).
6. Add a default subnet (e.g., `10.1.0.0/24`) for your virtual machines.
7. Click **Review + Create**.
8. Once created, open your new VNet, navigate to **Subnets** in the left menu, and click **+ Gateway subnet**.
9. Azure will automatically propose an address range (e.g., `10.1.255.0/27`). Accept the default and click **Save**. *Never deploy virtual machines into the GatewaySubnet.*
## Step 2: Deploy the Virtual Network Gateway
The Virtual Network Gateway is the compute resource that processes the VPN traffic.
*Note: Provisioning a VPN Gateway typically takes up to 45 minutes.*
1. In the Azure Portal, search for and select **Virtual network gateways**.
2. Click **+ Create**.
3. Configure the essential settings:
– **Name:** `Corp-VPN-Gateway`
– **Region:** Must match your VNet region.
– **Gateway type:** Select **VPN**.
– **VPN type:** Select **Route-based**.
– **SKU:** Select **VpnGw1** (The Basic SKU does not support modern IKEv2 protocols required by macOS clients).
– **Virtual network:** Select the `Corporate-VNet` you created in Step 1.
– **Public IP address:** Select **Create new** and name it `Corp-VPN-IP`.
4. Leave the remaining settings as default and click **Review + Create**.
## Step 3: Generate the Certificates
While Azure Active Directory (Entra ID) authentication is available for P2S, native Certificate Authentication is widely used as it requires no additional licensing and works seamlessly across operating systems.
You must generate a **Root Certificate** (which you upload to Azure) and a **Client Certificate** (which you install on the remote user’s PC).
We will use PowerShell on a Windows 10/11 machine to generate self-signed certificates for this deployment.
1. Open PowerShell as an Administrator.
2. **Generate the Root Certificate:**
“`powershell
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature -Subject “CN=AzureRootCert” -KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 -CertStoreLocation “Cert:\CurrentUser\My” -KeyUsageProperty Sign -KeyUsage CertSign
“`
3. **Generate the Client Certificate (derived from the Root):**
“`powershell
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature -Subject “CN=AzureClientCert” -KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 -CertStoreLocation “Cert:\CurrentUser\My” -Signer $cert -TextExtension @(“2.5.29.37={text}1.3.6.1.5.5.7.3.2”)
“`
### Export the Root Certificate for Azure
1. Press `Win + R`, type `certmgr.msc`, and press Enter.
2. Navigate to **Personal > Certificates**.
3. Right-click `AzureRootCert` > **All Tasks** > **Export**.
4. In the wizard, select **No, do not export the private key**.
5. Select **Base-64 encoded X.509 (.CER)**.
6. Save the file to your desktop.
7. Open the exported `.cer` file in Notepad. You will see a block of text between `—–BEGIN CERTIFICATE—–` and `—–END CERTIFICATE—–`. Copy *only the text between those lines*, ensuring there are no line breaks.
## Step 4: Configure the Point-to-Site Connection in Azure
Once your Virtual Network Gateway has finished deploying (which takes 45 minutes), you can configure the P2S settings.
1. In the Azure Portal, open your new `Corp-VPN-Gateway`.
2. In the left menu, select **Point-to-site configuration**.
3. Click **Configure now**.
4. **Address pool:** This is the private IP range assigned to remote clients when they connect. It cannot overlap with your VNet address space. Enter `172.16.0.0/24`.
5. **Tunnel type:** Select **IKEv2 and OpenVPN (SSL)** to ensure compatibility with Windows, Mac, and Linux.
6. **Authentication type:** Select **Azure certificate**.
7. **Root certificates section:**
– Under **Name**, type `RootCert`.
– Under **Public certificate data**, paste the block of text you copied from Notepad in Step 3.
8. Click **Save** at the top of the screen.
## Step 5: Download and Install the VPN Client
Once the configuration saves, Azure generates the necessary configuration files for your client computers.
1. At the top of the **Point-to-site configuration** page, click the **Download VPN client** button. This downloads a `.zip` file containing installers.
2. Extract the `.zip` file on the remote Windows computer.
3. Open the `WindowsAmd64` folder and run the executable to install the Azure VPN profile into the native Windows VPN client.
### Client Authentication
For the remote computer to successfully connect, it must possess the Client Certificate generated in Step 3.
If you are testing on the same machine where you generated the certificates, it is already installed. If you are distributing this to another employee’s computer, you must export the `AzureClientCert` from `certmgr.msc` *including the private key (as a .pfx file with a password)*, transfer it securely to the employee, and have them import it into their Personal certificate store.
## Step 6: Connect and Verify
1. On the Windows client, click the network icon in the system tray.
2. Select the new Azure VPN connection (named after your VNet) and click **Connect**.
3. You will be prompted to select a certificate. The system should automatically select the `AzureClientCert`.
4. Click **Connect**.
Once connected, open a command prompt and ping the private IP address (e.g., `10.1.0.4`) of a virtual machine deployed within your Azure VNet. The ping should succeed, confirming that you have successfully established a secure, encrypted tunnel from your local machine directly into your private Azure infrastructure.