SSTP VPN clients disconnecting every 60 minutes

Hi David Brown,

You can't use RRAS registry keys to control the TLS session resumption timeouts because the 60-minute renegotiation interval is a hardcoded security mechanism within the Windows Secure Channel provider. The operating system mandates this hourly cryptographic key refresh, and there are no supported registry values to disable or delay it.

The root cause is your web proxy intercepting the traffic. When the Windows server initiates the required hourly TLS renegotiation, proxies performing SSL inspection typically fail to handle the mid-stream cryptographic handshake and abruptly terminate the connection. To resolve this, you must configure your web proxy to bypass SSL inspection for the VPN server's external IP address, ensuring the traffic is treated as a pure, uninspected TCP passthrough. If network security policies prohibit bypassing SSL inspection, the only viable Microsoft-supported alternative is to migrate your remote access infrastructure from SSTP to IKEv2, which relies on IPSec rather than HTTPS and avoids proxy-induced renegotiation failures entirely.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN