Forum Discussion

Matthew Brice's avatar
Matthew Brice
Copper Contributor
Sep 16, 2026

SMB over QUIC stops working when enable Cert based Access Control

Trying to test out SMB over QUIC so can eliminate need for vpn. When setting "Set-SmbServerCertificateMapping -RequireClientAuthentication $true" (enabling Access Control) client can no longer connec...
windows server
Jamony's avatar
Jamony
MCT
Sep 17, 2026

Since SMB over QUIC already works without client authentication, I would focus on the client certificate/access-control configuration rather than the GoDaddy server certificate.

 

On the Windows 11 client, verify that the SCEP certificate is in the Local Computer personal store, contains the Client Authentication EKU, has a private key and chains to a CA trusted by the SMB server.

 

On the server, run:

 

Get-SmbClientAccessToServer -Name <server-fqdn>

 

and verify that the CA/issuer you added actually matches one of the certificates in the client's certificate chain. As a test, you can also allow the individual client certificate by its SHA256 identifier instead of the issuer.

 

Windows Server 2025 performs both certificate validation and the SMB access-control check when RequireClientAuthentication=$true. Entra-only clients are supported; an AD domain is not required for this mechanism. Also check Microsoft-Windows-SMBClient/Connectivity and Microsoft-Windows-SMBServer/Connectivity logs during the failed connection.