SMB over QUIC Client Access Control is inconsistent

Check Server Certificate Mapping

One of the common causes for this issue is that the server certificate mapping for SMB over QUIC is not correctly set up or is missing. For SMB over QUIC to authenticate properly, the server needs to map its certificate correctly for the client to trust it.

• Verify the certificate used by the server: Ensure that the server certificate used by SMB over QUIC has the appropriate subject alternative name (SAN) entries and is trusted by the client machines. It should be mapped correctly to the server in question.
• Check the certificate mapping on the server:
  • On the SMB server, open PowerShell as an administrator and run the following command to verify the certificate mapping for QUIC:

  • Verify Client Certificate Configuration

    Since you are using Client Access Control with certificates, check if the client certificates are properly configured and valid. This is crucial for the authentication process. Ensure that:

    • The client certificate is valid and issued by a trusted authority.
    • The client certificate is correctly configured to use in the SMB over QUIC connection (for example, correctly enrolled in the Windows Certificate Store).

    The client should be presenting a valid certificate when attempting to authenticate, and the server should trust this certificate based on your allowlist configuration.

    3. Ensure Correct Group Policy Settings

    SMB over QUIC may require specific Group Policy settings to be configured on both the server and client to work properly.

    • On the SMB server:
      • Open Group Policy Management and navigate to Computer Configuration > Administrative Templates > Network > SMB over QUIC.
      • Ensure that Enable SMB over QUIC is enabled.
    • On the client machine:
      • Verify that the client is configured to accept SMB over QUIC connections and that it has the necessary certificate installed for mutual authentication.
      • You may also want to check that the client is set up to trust the root certificate authority (CA) that issued the server's certificate.

    4. Monitor Logs for Additional Details

    Look at the Event Viewer logs for more details on why the authentication is failing. Specifically, check under the following logs:

    • System Logs: Look for any SMB or QUIC related entries that might give you more information on the failure, especially regarding authentication errors.
    • Application Logs: Check for any errors related to certificate validation or mutual authentication failures.

    In the Event Viewer, you can filter for logs related to SMB or QUIC and check the timestamps around the failed connection attempts to see if there are any related warnings or errors.

    5. Check for SSL/TLS Configuration Issues

    Ensure that there are no issues with SSL/TLS configuration on both the server and client. For SMB over QUIC to function properly, the server must support the TLS 1.3 protocol, and both sides must have compatible cipher suites.

    • Check the cipher suites supported by both the server and client:
      • On the server, run the following command to list the supported TLS cipher suites:
      •