SSTP

How the connection works

An SSTP connection establishes TCP and TLS before negotiating the tunnel and PPP. The Microsoft specification describes crypto binding and control packets. Supported authentication and certificates depend on the actual client and server.

Configuration checkpoints

• Verify the HTTPS server certificate and expected hostname before PPP authentication. The TLS connection and PPP login are separate stages.
• Check that the actual client and server support SSTP and the required PPP authentication method. Opening TCP port 443 alone does not configure an SSTP service.
• Review the routes and DNS assigned after authentication, then inspect separate TLS, SSTP and PPP errors when diagnosing failures.

Verify the traffic path

• Check IPv4 and IPv6 routes separately. A route for one address family does not demonstrate coverage of the other.
• Check the resolver used by the operating system and by applications that select their own DNS service. A public DNS lookup on this site does not test your device for DNS leaks.
• Observe a controlled disconnect on your own device. Protocol support does not establish a client kill switch or application-specific routing policy.

Diagnose a connection problem

Separate endpoint reachability, authentication, route selection and DNS resolution. Record the client version and the exact error; change one setting at a time. A handshake with no working traffic often needs route or resolver investigation, while an authentication error needs credentials or certificate checks.

Scope and limitations

Do not confuse Secure Socket Tunneling Protocol with unrelated protocols using the SSTP abbreviation. A reachable HTTPS port does not by itself prove that a VPN connection is accepted.

This page explains a mechanism and a verification approach. It contains no original speed, regional-access or leak measurements. Throughput depends on the implementation, device, path and server; a protocol name cannot identify a universal winner.