Fix ERROR_IPSEC_IKE_NO_PRIVATE_KEY (0X000035FC)

When This Error Shows Up

You see this error when setting up a site-to-site VPN or an IPsec tunnel on Windows Server (2016, 2019, 2022) or Windows 10/11. You've configured the IPsec policy to use a machine certificate for authentication. But when you try to establish the connection, the event log throws ERROR_IPSEC_IKE_NO_PRIVATE_KEY (0X000035FC).

Typical triggers: Right after you deploy a new certificate from your internal CA, or you copy a .cer file from another machine. The connection never comes up, and you're stuck staring at that error code.

Root Cause in Plain English

The certificate you're using has the public part only. It's like having a lock but no key. When Windows tries to sign the IKE negotiation messages, it needs the private key to prove the certificate belongs to this machine. If the private key isn't in the local machine's certificate store, the IKE process fails with this error.

This happens most often when you import a certificate from a file that doesn't include the private key. A .cer file never has it. A .pfx file can have it, but only if you checked the right boxes during export.

The Fix

You need to get a certificate that includes the private key into the Local Machine certificate store. Not the current user store — the machine store.

1. Open the Microsoft Management Console (MMC)

   Press Win + R, type mmc, and hit Enter. If you get a UAC prompt, click Yes.

   After MMC opens, you'll see a blank console.

2. Add the Certificates snap-in

   Go to File > Add/Remove Snap-in. Find Certificates in the list on the left. Click it, then click Add.

   A dialog pops up asking which account. Select Computer account, then click Next.

   On the next screen, choose Local computer and click Finish. Then click OK.

   Now in the left pane you'll see Certificates (Local Computer).

3. Find the certificate that's giving you trouble

   Expand Certificates (Local Computer) > Personal > Certificates.

   Look for the certificate you're using in your IPsec policy. If it's not in Personal, check Trusted Root Certification Authorities or Intermediate Certification Authorities.

   Double-click the certificate. In the window that opens, look at the bottom: it should say You have a private key that corresponds to this certificate. If it says No or doesn't mention it at all, that's your problem.

   Close that window.

4. Replace the certificate with one that has the private key

   You need to get a .pfx file from your CA that includes the private key. If you don't have one, you can request a new certificate from your internal CA with the Exportable private key option checked.

   Once you have the .pfx file:

   • Right-click the Personal folder under Certificates (Local Computer).
   • Select All Tasks > Import.
   • Browse to your .pfx file. Check Mark this key as exportable (helps if you ever need to move it).
   • Enter the password if there is one. Leave Automatically select the certificate store checked.
   • Click Next, then Finish.

   After the import, you should see the certificate appear with a small key icon on it. That key icon means the private key is there.

5. Update the IPsec policy to use the new certificate

   Open your IPsec policy settings (usually through Windows Firewall with Advanced Security or the IP Security Policy Management snap-in).

   Go to the rule or connection security rule that uses the certificate. Click Edit.

   Under the authentication method, select Computer certificate. Click Browse and pick the newly imported certificate from the list. Click OK.

   Apply the changes. If you're using a local policy, run gpupdate /force from an admin command prompt. For remote policies, wait for the next refresh or restart the IPSec Policy Agent service.

If It Still Fails

Check these three things:

1. Certificate chain — Open the certificate again and look at the Certification Path tab. Every certificate in the chain must be present in the local machine store. If the root CA is missing, the IKE negotiation won't trust your certificate. Download and import the root and any intermediate CA certificates into the appropriate stores (Trusted Root for root, Intermediate for intermediates).
2. Private key permissions — Right-click the certificate in the MMC, select All Tasks > Manage Private Keys. Make sure the NETWORK SERVICE account has Read access. The IPSec service runs under that account. If it can't read the key, you get the same error.
3. Certificate template — If you're using a custom template, verify it allows the private key to be exported and that it's marked for Client Authentication and Server Authentication in the Enhanced Key Usage. Without those, IPsec won't accept it.

After fixing any of these, restart the IPsec Policy Agent service and try the connection again.