• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1396
  • Last Modified:

Wireless and Windows NPS for non-domain clients

I have a Windows 2008 R2 server setup as a RADIUS/NPS for wireless clients.  It works fine for Windows 7 and Windows 8 machines that are members of the domain.  When a non-domain client tries to associate with the wireless they are challenged for the username & password but are not able to connect.  The system lg has an Schannel entry with event ID 36887.  The body of the message says "The TLS protocol defined fatal alert code is 48."  EventID.net says code 48 is a "TLS1_Alert_Unknown_CA".  This makes sense.  I'm using a Windows certificate for the NPS server. A non-domain member would have an issue with the CA for a self issued certificate.

My questions are can I use a 3rd party cert for the NPS server and what are the steps for initiating the certificate request and installing this certificate?

Tx

Bill
0
labdunn
Asked:
labdunn
1 Solution
 
JAN PAKULAICT Infranstructure ManagerCommented:
yes your cert is not trusted by non domains client


get your self cert from trusted ca (preferably wildcard one)


and follow that

http://www.youtube.com/watch?v=159sP_ExWDg

and that

http://technet.microsoft.com/library/cc771696.aspx
0
 
GiladnCommented:
Hi, If I understand your question right then janpakula is correct, non domain members are unable to trust the certificate, this is why 3rd party certificates are expensive, they can be trusted  :)
are those clients dynamic? is installing the self signed certificate on every device not an option?

I'm using SSL wildcard certificate from Godaddy
http://www.godaddy.com/ssl/ssl-certificates-new2.aspx
works fine, expensive though..
0
 
JAN PAKULAICT Infranstructure ManagerCommented:
yup - i also use Godaddy :)
0
 
Jakob DigranesSenior ConsultantCommented:
Well - you could also bypass this by unchecking the "validate server identity" on non-domain clients.
What non-domain clients do you have?
and is your domain a .local domain, or a public routable, like .com or similar?
from 2017 Public CAs won't issue certificates to "local" domain names
0
 
labdunnAuthor Commented:
Got a godaddy cert and non-domain clients are now able to connect.

Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now