How does my NPS certificate work?

Posted on 2015-02-19
Medium Priority
Last Modified: 2015-02-20

I've had to pick up a NPS RADIUS configuration since a colleague left.

It's all configured but I'm struggling to understand how it's strung together - mainly for the certificate side of things.

There is a "wireless connection" certificate created which apparently is the certificate needed in order to authenticate to the wireless network. This is set to auto enroll.

The issue is, looking at the config on the NPS server, I cannot see anywhere where it actually states that this is the certificate that should be used. Under the connection policy, I can see it requires authentication via a certificate. I assumed it would be a case of telling the policy which cert to use but all I can see is the CA server listed under the settings.

It's the first time I've dealt with certs which is why I'm struggling really.
I have raised another question about an issue I get with being auto enrolled but that's another topic.

How on earth does the policy know which certificate I should have in order to allow me to connect?

Any help/advice would be welcome.

Question by:MFAFC
  • 2

Author Comment

ID: 40619022
Is it because the certificate simply has "server authentication" as one of it's intended purposes that allows me to connect?
LVL 22

Accepted Solution

Jakob Digranes earned 1000 total points
ID: 40619775
Yes --- you're quite right in your own comment. There is no place in the policy that specify what certificate can be used. You'd need the client authentication (or server authentication) intended purpose. If you have only one certificate, windows will select this - if you have multiple - it will ask you to choose using a dialog box that pops up before authentication
LVL 31

Assisted Solution

by:Rich Weissler
Rich Weissler earned 1000 total points
ID: 40619864
The certificate requirement depends on what is being authenticated.  From Microsoft Technet:
"For example, a certificate used for the authentication of a client to a server must be configured with the Client Authentication purpose. Similarly, a certificate used for the authentication of a server must be configured with the Server Authentication purpose. "

Author Comment

ID: 40620727
Thank you both for taking the time to help.

Featured Post

We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

In this article, we’ll look at how to deploy ProxySQL.
Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question