Exam AZ-720 topic 4 question 33 discussion

A. Reissue the client certificate with client authentication enabled. OpenVPN relies on certificate-based authentication. If the users are seeing a certificate mismatch error, it might be because the client certificate was not properly issued with client authentication enabled. So, reissuing the client certificates with client authentication enabled should resolve this error. Option B, installing a Secure Socket Tunneling Protocol (SSTP) VPN client on the users' computers, would not necessarily fix a certificate mismatch error with OpenVPN. Option C, reissuing the client certificate with server identity validation disabled, may bypass some checks but it's not a secure approach as it opens up potential vulnerabilities. Option D, configuring a preshared key for authentication on the VPN profile, would not address the certificate mismatch issue, as the error is related to certificate-based authentication, not preshared key authentication.

I say A. "Make sure the client certificate is based on a user certificate template that has Client Authentication listed as the first item in the user list." https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal#generateclientcert

I agree it should be A. Once you create a server certificate you need to issue the client certificate to the users. If a problem persists, then it should be reissued from the clients' side to resolve it.

Reissue the client certificate with client authentication enabled.