Fix ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH 0X0000363F

What's happening here?

You're trying to connect to a VPN or IPsec tunnel, and you get this error: ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH (0X0000363F). Windows is saying "Hey, the certificate the server sent me doesn't chain up to a root certificate I trust." In plain English: your computer doesn't trust the certificate authority that signed the server's certificate.

This usually happens when you're connecting to a company VPN and the IT folks use their own internal certificate authority. Your computer isn't in their domain, or you're on a laptop that hasn't been configured properly. You might also see this after a Windows update that resets certificate trust settings.

Let's fix it. I'll start with the quickest thing to try, then move to more involved steps. Stop when the error goes away.

Quick fix: Add the root certificate (30 seconds)

First, check if you just need to install the root certificate. Your IT department or VPN provider should be able to give you a file called something like root-ca.cer or company-root.crt.

1. Download the root certificate file from your IT team or VPN provider. Save it to your desktop.
2. Right-click the file and choose Install Certificate.
3. A wizard opens. Select Local Machine (this is important — don't pick Current User). Click Next.
4. Choose Place all certificates in the following store, then click Browse.
5. Pick Trusted Root Certification Authorities. Click OK, then Next, then Finish.
6. After the import completes, you should see a message saying "The import was successful."

Now try connecting to your VPN again. If it works, you're done. If not, move to the next section.

Moderate fix: Check the Intermediate CA store (5 minutes)

Sometimes the problem isn't the root certificate — it's that the intermediate certificate authority is missing. Windows needs the full chain: server cert → intermediate → root. Let's check.

1. Press Windows Key + R, type certlm.msc (that's the local machine certificate manager), and press Enter.
2. In the left panel, expand Intermediate Certification Authorities, then click Certificates.
3. Look in the right panel for any certificates from your company or VPN provider. You might see names like Company Name CA or VPN Issuing CA.
4. If you don't see anything from your provider, you need to import the intermediate certificate the same way you did the root.
5. Ask IT for the intermediate CA file (often named intermediate-ca.cer). Install it via the same wizard, but this time put it in Intermediate Certification Authorities instead of Trusted Root.
6. After importing, close certlm.msc and try the VPN again.

Still failing? Let's check if the certificate itself is expired or has wrong settings.

Advanced fix: Verify certificate details and policy (15+ minutes)

This is where we dig deeper. The error mentions "policy mismatch" — that's a fancy way of saying the certificate has some rules about when it can be used, and your connection isn't meeting those rules.

Step 1: Look at the server's certificate

1. Open certlm.msc again.
2. Go to Trusted Root Certification Authorities → Certificates and find your company's root certificate.
3. Double-click it. Look at the Details tab.
4. Check the Valid from and Valid to dates. If it's expired, that's your problem. You'll need a new one from IT.
5. Also check the Enhanced Key Usage field. It should say something like "Server Authentication" or "IP security IKE intermediate." If it says nothing, that might be okay — but if it says something weird like "Code Signing," the certificate isn't meant for VPN and you need to get the right one.

Step 2: Check if the root certificate is in the right registry location

Some Windows settings override the certificate store. Group Policy can block certain roots. Let's check.

1. Press Windows Key + R, type regedit, and press Enter. Say yes to the UAC prompt.
2. Go to this key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
3. If that path doesn't exist, group policy isn't interfering — that's good. Move on.
4. If it does exist, look for a subkey with a long hex string. That might be your root certificate being blocked or replaced.
5. You might want to export this folder (right-click → Export) and send it to IT for review before making changes.

Warning: Deleting or changing registry keys can break things. Only do this if you know what you're doing, or ask IT to help.

Step 3: Re-enroll or request a new certificate

If your computer is supposed to automatically get certificates from your company's server (via auto-enrollment), it might have gotten a bad one. Force a refresh.

1. Open a command prompt as administrator (right-click Start → Windows Terminal (Admin)).
2. Type gpupdate /force and press Enter. Wait for it to finish — it'll say "Computer Policy update has completed successfully."
3. Then type certreq -autoenroll and press Enter. This tries to grab any new certificates the server has for you.
4. After it runs, restart your computer and try the VPN again.

Still stuck? What to tell IT

If none of this worked, you need to talk to your IT department. Tell them exactly what you did:

• "I tried installing the root certificate into Trusted Root Certification Authorities."
• "I checked the intermediate store and imported that too."
• "I verified the certificate isn't expired."
• "I ran gpupdate and certreq -autoenroll."
• "I'm still getting error 0x0000363F."

They'll probably need to check their VPN server's certificate or give you a specific certificate package. Don't be shy — this error is common, and any good IT team has seen it before.

One last thing: if you're using a personal VPN service like NordVPN or ExpressVPN and see this error, contact their support. They handle certificates differently, and you shouldn't be messing with root stores on your own for those services.

Good luck. You got this.