Solved

NPS Certificate

Posted on 2013-12-02
11
1,369 Views
Last Modified: 2013-12-18
We have a wireless solution through our building.  Network Policy Server (NPS)is setup on a windows 2008 domain controller server2.  The domain controller gets its certificate from a windows 2008 std domain controller server1 running certificate authority.  over the weekend server2 certificate expired.  I renewed it with the internal CA.  Now I am getting an error that EAP cannot be processed by the server when wifi clients try to authenticate with NPS.  When seeing what certificate EAP uses I get the below error.  I cannot find a way to add the subject name into the certificate and dont recall every having to do this.

Lastly, should NPS be installed on a DOMAIN Controller?  Im finding that it shouldnt

http://morgansimonsen.wordpress.com/2012/01/25/a-certificate-cloud-not-be-found-that-can-be-used-with-this-extensible-authentication-protocol-error-in-ias/
0
Comment
Question by:silvercas
  • 5
  • 5
11 Comments
 
LVL 46

Expert Comment

by:Craig Beck
ID: 39690744
First, NPS can be installed on a DC if you need it to be.  You can install it on SBS, so it's fine.  It's recommended to install on a different box for performance and role separation only.

The NPS server can use certificate autoenrolment (and I would recommend it) so you don't ever find that you've forgotten to obtain a new certificate.  However, you need to choose the new certificate in NPS when you've obtained it.

You don't need to add a subject name to the certificate.  Simply enrol for a computer certificate and use that.
0
 

Author Comment

by:silvercas
ID: 39690832
so i just got this working.  upon reviewing my certificates I found I was missing or lacked one from before.  I just had an active certificate with the certificate template of directory email replication and domain controller authentication.  Once I requested a certificate with the template domain controller, everything came back to life.  reading some posts particularly the below one made me realize this

http://setspn.blogspot.com/2010/12/error-selecting-certificate-when.html?showComment=1313245992613#c778045168030747809


regarding the post above, it appears you do need the subject.  I am unable to associate a certificate for peap without a subject
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 39690870
You 100% don't need to configure a subject name in the certificate when you request a computer certificate as the computer's identity IS the subject and can't be changed.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:silvercas
ID: 39690879
but these werent computer certs they are domain controller certs
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 39690905
It doesn't matter... the identity of the machine is what matters when providing a certificate for NPS.  If the machine NPS is running on is a DC you don't need to enrol for a certificate at all as long as the CA certificate is valid.
0
 

Assisted Solution

by:silvercas
silvercas earned 0 total points
ID: 39690946
if the cert doesnt have a subject I was unable to associate it with peap
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 39690961
My point is that the certificate does have a subject and you can't change it, so you can't specify it.  The certificate subject is the computer identity.
0
 
LVL 4

Assisted Solution

by:askincakir
askincakir earned 250 total points
ID: 39691881
Hi,

The simplest way of getting right certificate is to install IIS on the machine where is NPS installed. In IIS management/certificates site you can request a certificate from your domain CA and it would be also suitable for your NPS. After getting the certificate from IIS, at the NPS site you can use it with no problems.
0
 
LVL 46

Accepted Solution

by:
Craig Beck earned 250 total points
ID: 39692356
...or just enrol for a computer certificate!

http://technet.microsoft.com/en-us/library/cc730811.aspx

Pay special attention to the caution at the bottom.
0
 

Author Comment

by:silvercas
ID: 39692413
I appreciate all the feedback.

I read about the idea of installing IIS.  I dont want to venture down this path as this is a DC and already has enough on it.  Configuring another server for NPS is looking more like a reality soon

This morning as I read my domain controller certificate disappeared since a newer domain controller authentication certificate was already in place.  I believe that I can get the domain controller certificate again and expire the domain controller authentication cert.  Any words of caution?  The current NPS server is a Domain Controller.

One last point when I try to request a certificate other than the three I mentioned, they are listed as unavailable.  From reading this is a security setup issue?
0
 

Author Closing Comment

by:silvercas
ID: 39726173
NPS moved off DC
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This subject  of securing wireless devices conjures up visions of your PC or mobile phone connecting to the Internet through some hotspot at Starbucks. But it is so much more than that. Let’s look at the facts: devices#sthash.eoFY7dic.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question