RemoteAccess (RRAS) service deadlocks on stop/restart during SSTP certificate rotation — Windows Server 2025

Question

RemoteAccess (RRAS) service deadlocks on stop/restart during SSTP certificate rotation — Windows Server 2025

Antonin Homola 0

Environment: Windows Server 2025, RRAS with SSTP VPN + IIS on same box. Certificates issued by win-acme (Let's Encrypt), applied via Set-RemoteAccess -SslCertificate followed by a RemoteAccess service restart.

Issue: After applying a new SSTP certificate, stopping/restarting RemoteAccess (via Stop-Service, Restart-Service, or net stop) reproducibly hangs in STOP_PENDING indefinitely. Reproduced twice so far, always shortly after a live cert binding update.

Key evidence:

sc.exe queryex RemoteAccess
STATE      : 3  STOP_PENDING (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
CHECKPOINT : 0x3   (never advances)
PID        : 1084

taskkill /PID 1084 /F  -> "SUCCESS"
Get-Process -Id 1084   -> process still exists, CPU(s) not increasing

Process (svchost.exe hosting only RasMan + RemoteAccess) does not actually terminate even after TerminateProcess succeeds — consistent with a thread stuck in an uninterruptible kernel-mode wait. Only a full VM power-cycle clears it; graceful OS shutdown also hangs on this service.

Ruled out:

Active VPN sessions (\RAS Total\Total Connections = 0 at time of hang)

Certificate/private key problems (reproduced with a fresh, fully valid cert)

SCM circular dependency (sc qc RemoteAccess/sc qc SstpSvc show no mutual dependency)

Our own automation script bugs (relative path issue found & fixed separately)

No error events logged in System/Application logs at time of hang

Questions:

Known Server 2025 RRAS/RasMan deadlock when restarting RemoteAccess shortly after Set-RemoteAccess -SslCertificate?

Supported safer sequence to rotate SSTP cert at runtime without this hang (e.g. stop SstpSvc first, or Set-VpnServerConfiguration -SstpPorts 0 before restart)?

Which ETW/kernel trace should we capture live next time this reproduces (e.g. Microsoft-Windows-RasSstp, WPR profile, procdump)?

Any relevant hotfix/KB for Server 2025 RRAS stop hangs?

Happy to provide a live kernel dump or ETW trace of the stuck svchost.exe next time it reproduces — please advise preferred collection method.

0 comments

1 answer

Your answer

Answer 1

Hi Antonin,

Thank you for the detailed investigation. Based on the information you’ve shared, I don’t believe this matches any currently documented Windows Server 2025 RRAS known issue or published hotfix.

1. Is this a known RRAS/RasMan deadlock after

Set-RemoteAccess -SslCertificate

?

At this time, Microsoft has not published a KB article or Release Health advisory describing a reproducible RemoteAccess service deadlock after rotating the SSTP certificate on Windows Server 2025.

Your observations are consistent with a thread becoming blocked in kernel mode, particularly because:

RemoteAccess remains indefinitely in STOP_PENDING.
TerminateProcess reports success, but the svchost.exe process never actually exits.
Graceful shutdown also blocks on the service.
Only a VM power cycle clears the condition.

Those symptoms generally indicate that at least one thread cannot return from a kernel-mode wait rather than a normal Service Control Manager timeout.

2. Is there a supported certificate rotation sequence?

Microsoft does not currently document a special certificate rotation procedure beyond updating the certificate and restarting the RRAS service.

As a precaution, you could test whether performing the rotation during a maintenance window with no active SSTP connections reduces the likelihood of the issue. If the problem consistently occurs immediately after rebinding the certificate, that information would be valuable for Microsoft Support.

3. What diagnostics should be collected?

If the issue reproduces again, I would recommend collecting the following before powering off the VM:

A kernel memory dump, since the blocked thread may be waiting in kernel mode.
A WPR trace covering networking and service activity.
An ETW trace including RRAS/RasMan-related providers, if possible.
A user-mode dump of the affected svchost.exe instance hosting RemoteAccess and RasMan, although if the thread is blocked in kernel mode, the kernel dump will usually provide more useful information.

These artifacts would give Microsoft engineering the best chance of identifying where the stop request is blocked.

4. Are there any available hotfixes?

At present, I’m not aware of any public hotfix or cumulative update that specifically addresses this behavior on Windows Server 2025.

If the issue is reproducible, I would recommend opening a Microsoft Support case. Given the kernel-mode symptoms and the fact that the problem occurs immediately after certificate rotation, this is the type of issue that typically requires internal debugging with private symbols.