Shad_

I spent some time trying to duplicate the issue after removing the personal store certs by backing them up and re-adding them later, but no dice. I only had one that had a key and tried removing/adding with/without the key, no change. Perhaps Ayyad1231 still has this issue. If I have the problem again, I'll investigate further.

I thought it might be a TLS issue, as Wireshark showed a difference between a problem connection: 142.132.137.205 192.168.0.221 TLSv1.2 827 Certificate, Server Key Exchange, Certificate Request, Server Hello Done 192.168.0.221 142.132.137.205 TLSv1.2 1341 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message vs a successful connect: 142.132.137.205 192.168.0.221 TLSv1.2 828 Certificate, Server Key Exchange, Certificate Request, Server Hello Done 192.168.0.221 142.132.137.205 TLSv1.2 154 Certificate, Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message the difference being that for the problem connection, the client responds to the "Certificate Request" with "Certificate Verify". For a successful connection, it might be normal for Schannel to not send this back when the certificates are removed (or a user didn't have any in the first place), I am not familiar with Schannel and TLS1.2 responses. Does the default.cfg setting verify_certificates have anything to do with the certificate request? I've tried both true and false settings. I did try adding the certificates back one at a time, and I no longer have the problem with any certificate, if one was a problem. It had been a long while since I connected with and older version of 0AD before upgrading to the new one. Maybe a cache was corrupted somehow, and maybe clearing that cache (through inetcpl.msc)? may work, but I can no longer duplicate the problem to test this. I had 9 certs, only 1 with a key, and 1 expired, but again, adding them back in did not duplicate the issue.

I had this problem recently, it might be your issue. I have many security certificates installed by various programs in my Windows 10 Personal Store. When 0AD tries to connect, it uses wrong info from the first 'valid' certificate it finds, whereas having none at all connects fine. Reinstalling Windows, Creating a new Windows user or removing the certificates in the Windows 10 Personal Store does the same thing to fix that issue. To check, just hit Win+R and type certmgr.msc and look at the Personal/Certificates folder. If you have certs in there, it may be the issue. I was able to back them up and remove them to test it out. How to back up security certificates May be an issue with how mTLS interacts with Windows