If there are one or more valid certificates, and none or more than one has IP security IKE intermediate in the EKU property, ...

If there are one or more valid certificates, and none or more than one has IP security IKE intermediate in the EKU property, then RRAS does not know which certificate to use, and selects one at random. The selected certificate might not be the one intended for use.