c2s nmas error

I upgraded my BM 3.8sp5 server to 65sp8 and edir 8.8.5 yesterday, everything came up ok except for the c2s vpn. The client gets an FFFFF98C error, and I don't see anything on the IKE screen. Audit log shows 0xFFFFF95F, and also an occasional 0xFFFFFD86 errors. Below is the NMAS trace.

31: Create NMAS Session
31: Pregathered information NMAS_AID = 1 value xxxxx.xx.xxx
31: Pregathered information NMAS_AID = 11 value NDS
31: NMAS Client supplied user DN user
Attempting to create key
ERROR: -1423 wrapKey: CCS_WrapKey
ERROR: -1423 Failed to get encryption key for xxxxx.xx.xxx
31: NMAS Login not supported for user xxxxx.xx.xxx
31: Destroy NMAS Session
31: ERROR: -1697 Failed to started login refresh session

I've looked at a few TID's, but they seem to point in different directions. Any idea what is going on here, and how I can fix it?

Thanks