So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post.
Post is the answer. Specifically, SSTP is basically SSL, with special body specific to a tunnelling protocol. You can read the full spec here, but it's a little dry. Essentially, your options are these:
- Authenticate through SSL/TLS certificates as you would for any SSL-certificate authenticated site, then establish the wrapped tunnel protocol, authenticating as you go.
- Go through the standard key negotiation with SSL, then authenticate over your choice of P2P tunnelling protocol, e.g. with MSCHAPv2. Doing this, your tunnel is already encrypted via the HTTPS part.
From the standard:
Because SSTP runs by means of an HTTPS connection, SSTP relies entirely on HTTPS for the reliable
delivery of its messages. The SSTP client MUST authenticate the SSTP server by using HTTPS
authentication. The SSTP server MAY<1> authenticate the SSTP client by using HTTPS client
authentication. The SSTP server SHOULD authenticate the SSTP client by using PPP authentication.
Therefore, PPP authentication is required even when the SSTP server authenticates the SSTP client
by using HTTPS authentication. For more information about PPP authentication, see [RFC1661]
The essential difference between SSTP and PPTP is the requirement to route TCP over TCP, needed to make this an SSL connection. This has a performance impact, since TCP packets are much less efficient to send and receive than UDP packets or GRE datagrams, the latter being how you'd typically set up a PPTP tunnel.