Windows Server 2022. VPN/SSTP с обязательной проверкой сертификата Клиента

Клиент: Windows11 (не доменный). Сервер: DC на Windows Server 2022. Установлены роли Certification Authority, RAS, NPS (RADIUS не используется).
Надо поднять VPN/SSTP с обязательной проверкой сертификата Клиента.
Параметры для сертификатов:
Для сертификата клиента Key Usage:Digital Signature, Key Enchipment; Application Polices:Client Authentication, Secure Email, Ecrypting File System; CN=Имя Юзера Домена; Расположение на клиенте:Current User->Personal Еще корневой сертификат Сервера на Расположении:Local Computer->Trusted Root Certification Authorities
Для сертификата Сервера Key Usage:Digital Signature, Key Enchipment; Application Polices:Server Authentication; CN=server.local (на hosts ip сопоставлено с этим именем); Расположение на сервере:Local Computer->Personal.
Все сертификаты (на Сервере, на Клиенте) действительные.
На RAS указан SSL сертификат сервера, и выбран Authentication Methods:Extensible authentication protocol(EAP). NPS->Network Policies->Constraints->Authentication Methods выбран Microsoft: Protected EAP(PEAP) с Eap Types:Smart Card or other certificate.
Что бы убедится что, брандмауэр Windows не блокирует VPN-соединение, во время проверки брандмауэр отключен. На клиенте так же отключен проверка отзыва сертификатов.
На клиенте Свойство подключения->Security->Type of VPN выбран SSTP и выбран Authentication Methods:Extensible authentication protocol(EAP)->Microsoft: Protected EAP(PEAP)(encryption enabled). На Proteced EAP Properties->Select Authentication Method указан Smart Card or other certificate (EAP-TLS) и выбран Use a certificate on this computer.
С помощью rasphone -d "ConnectionName" получаю ошибку 0x9009030C.

    Логи На Сервере.  
    1. Event Viewer->Network Policy And Access Services->Microsoft Windows  
Security Auditing - "Network Policy Server denied access to a user.  
    User: Security ID:          SERVER\USER  
        Account Name:           USER  
        Account Domain:         SERVER  
        Fully Qualified Account Name:   server.local/Users/USER  
    Client Machine: Security ID:            NULL SID  
        Account Name:           -  
        Fully Qualified Account Name:   -  
        Called Station Identifier:      xxx.xxx.xxx.xxx  
        Calling Station Identifier:     yyy.yyy.yyy.yyy  
    NAS:  
        NAS IPv4 Address:       xxx.xxx.xxx.xxx  
        NAS IPv6 Address:       -  
        NAS Identifier:         SRV1  
        NAS Port-Type:          Virtual  
        NAS Port:           513  
    RADIUS Client:  
        Client Friendly Name:       SRV1  
        Client IP Address:          xxx.xxx.xxx.xxx  
    Authentication Details:  
        Connection Request Policy Name: Microsoft Routing and Remote Access Service Policy  
        Network Policy Name:        VPN  
        Authentication Provider:        Windows  
        Authentication Server:      SRV1.server.local  
        Authentication Type:        PEAP  
        EAP Type:           Microsoft: Smart Card or other certificate  
        Account Session Identifier:     3935  
        Logging Results:            Accounting information was not written to any data store.  
        Reason Code:            16  
        Reason:             Authentication failed due to a user credentials mismatch.  
Either the user name provided does not map to an existing user  
account or the password was incorrect."  
    2. Event Viewer->Remote Access" - The user USER (здесь USER доменный юзер на чье имя получен  
сертификат) connected from xxx.xxx.xxx.xxx but failed an authentication attempt  
due to the following reason: The remote connection was denied because the user name  
and password combination you provided is not recognized, or the selected  
authentication protocol is not permitted on the remote access server." 
    
    ----------
    
    Логи На Клиенте:  
    1. Event Viewer->Application->Error - "The user USER-PC\USER (здесь USER-PC -  
не доменный клиентский компьютер, USER - не доменный юзер чье имя совпадает с  
доменным юзером) dialed a connection named server.local which has failed. The  
error code returned on failure is -1878457588."  
    2. Event Viewer->Application->Information - "The user USER-PC\USER has  
started dialing a VPN connection using a per-user connection profile named  
'server.local'. The connection settings are:   
    Dial-in User =  
    VpnStrategy = SSTP  
    DataEncryption = Requested  
    PrerequisiteEntry =  
    AutoLogon = No  
    UseRasCredentials = Yes  
    Authentication Type = EAP <Microsoft: Protected EAP (PEAP)>  
    Ipv4DefaultGateway = Yes  
    Ipv4AddressAssignment = By Server  
    Ipv4DNSServerAssignment = By Server  
    Ipv6DefaultGateway = Yes  
    Ipv6AddressAssignment = By Server  
    Ipv6DNSServerAssignment = By Server  
    IpDnsFlags =  
    IpNBTEnabled = Yes  
    UseFlags = Private Connection  
    ConnectOnWinlogon = No."