Issues with MS RAS server

We are running Windows server 2019 with RAS role and have a second server that is Windows server 2019 with NPS role. We are experiencing problems with VPN connection for a group of users located in a different AD forest. These users are not able to authenticate and receive an error message:

 Can’t connect to VPN User Tunnel The remote access connection completed, but authentication failed because the certificate that authenticates the client to the server is not valid. Ensure that the certificate used for authentication is valid.

In event logs we see errors:

• System   - Provider    [ Name]  RemoteAccess   - EventID 20271    [ Qualifiers]  0    Level 3    Task 0    Keywords 0x80000000000000   - TimeCreated    [ SystemTime]  2024-09-15T18:17:33.908487400Z    EventRecordID 13255841    Channel System    Computer VPN.domain.local    Security  - EventData    {74530D90-09AB-0007-E3A7-6074AB09DB01}    user@domain.com    IP ADDRESS    The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error.    0x70    2C030000  -------------------------------------------------------------------------------- Binary data: In Words 0000: 0000032C     In Bytes 0000: 2C 03 00 00               ,... Currently rebooting both servers help with solving the issue.