Fix 0X00003644: IPsec IKE CGA Auth Failed Error

Quick answer: Re-issue the machine certificate with the correct Subject Alternative Name (SAN) that matches the adapter's IP address, or switch to a static IP for the VPN interface.

What's going on here?

This error popped up for me on a Windows 10 machine connecting to a Windows Server 2019 VPN endpoint. The full message is: "Could not verify the binding between the color graphics adapter (CGA) address and the certificate." It's confusing — CGA here is a legacy term from the IPsec protocol, not your graphics card. It refers to how the network adapter's IP address is cryptographically tied to the certificate.

I've seen this mostly in two scenarios:

• When using IKEv2 VPN with machine certificates on a DHCP-enabled network where the IP changes
• After a certificate renewal where the new cert doesn't include the old IP binding

Windows expects the certificate to have a Subject Alternative Name (SAN) with the IP address of the interface using IPsec. If they don't match — boom, error 0x00003644.

The fix steps

Step 1: Check your certificates

1. Open mmc.exe and add the Certificates snap-in for Computer account (Local computer).
2. Go to Personal > Certificates.
3. Double-click the cert used for IPsec (usually issued by your domain CA).
4. Go to the Details tab and scroll to Subject Alternative Name.
5. Look for an entry like IP Address: 192.168.1.50. If it's missing or has a different IP, that's your problem.

Step 2: Generate a new cert with the right IP

If you're using a domain CA, request a new certificate with the correct SAN. On the machine getting the error, run this in an elevated PowerShell:

$ip = (Get-NetIPAddress -InterfaceAlias "Ethernet" -AddressFamily IPv4).IPAddress
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*CN=YourServerName*"}
# Replace "YourServerName" with your machine's name
# Then request a new cert via certreq or CA web enrollment with the IP as SAN

If you're using a self-signed cert (for testing), generate it with SAN like this:

New-SelfSignedCertificate -DnsName "192.168.1.50" -CertStoreLocation Cert:\LocalMachine\My -TextExtension @("2.5.29.17={text}ipaddress=192.168.1.50")

Replace the IP with your actual VPN adapter's IP.

Step 3: Update the IPsec policy

Sometimes the policy itself is cached. Flush it:

net stop IKEEXT
net stop PolicyAgent
net start PolicyAgent
net start IKEEXT

Step 4: Test the connection

Try your VPN again. If the error is gone, good. If not, move to the alternatives below.

Alternative fixes if the main one doesn't work

Use a static IP for the VPN interface

I've seen this on laptops switching networks. Assign a fixed IP to the VPN adapter in the dial-up settings. Go to Network Connections, right-click your VPN, Properties > Networking > Internet Protocol Version 4 (TCP/IPv4) > Properties, and set a static IP like 10.0.0.2 (use one that won't clash with your LAN).

Disable CGA checking (not recommended for production)

If you're testing and don't care about security, you can tell Windows to skip the binding check. Add this registry key and reboot:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]
"AssumeUDPEncapsulationContextOnSendSite"=dword:00000002

This is a bad idea for real networks — it disables a security check. Use only for lab testing.

Check for DHCP race conditions

If your computer gets a new IP after boot, and the IPsec service starts before the IP is stable, you get this error. Add a delay to the IPsec service:

1. Open services.msc.
2. Find IKE and AuthIP IPsec Keying Modules (IKEEXT).
3. Set Startup type to Automatic (Delayed Start).
4. Restart.

Prevention tips

• Always include the IP in your certificate's SAN — even if you think it'll stay the same. DHCP changes happen.
• Use hostnames instead of IPs in your VPN configuration when possible. IKEv2 can resolve names, and it avoids the CGA binding issue entirely.
• Renew certificates before they expire — a rushed renewal is where I usually see this error caused by missing SANs.
• Keep a static IP on the VPN adapter if you're on a domain with strict IPsec rules.

I've fixed this on maybe a dozen machines now, and 9 times out of 10 it's the certificate SAN. The other one is a wonky DHCP lease. Don't let the error code scare you — it's just Windows being picky about its crypto handshake.