Wifi – Setting up NPS with a certificate that is valid to both AD and non-AD machines

I had exactly this problem and solved it by downloading the DigiCert SSL Certificate Checker and running it on my IAS servers. The tool stated that one of the intermediary certificates, was incorrect and offered to install a new one. Looking at the certificate store, the tool installed a new DigiCert High Assurance CA-3, even though an apparently valid certificate was present. I checked the new certificate against the one it replaced, both had the same version number and expiry date, just a different serial number. Not sure what was wrong with the previous but it all worked with the new one.

Cisco Access points can use two common forms of 802.1X per-user authentication. 802.1X EAP would require certificates for the NPS server, the client computers, and the client users. This is most often only accomplished by using smart cards so the user's certificate follows them.

The other, and more common, method of using 802.1X to do per-user authentication is 802.1X PEAP, which uses a certificate on the NPS server so the clients can validate the server, and the user's Windows username and password for client authentication when the user logs on. Additionally, the Windows domain computer account is used for wireless authentication when no users are logged on, so it is important to remember if you are using groups in the NPS rule, include a group that has all computers in addition to all users.

Note that the access point does not get a certificate. The client is called the "supplicant" and the server needs to authenticate it. The NPS server is the "authentication server," and the clients need to authenticate it. However, the access point is called the "authenticator" and is being a middle man between the supplicant and the authentication server, so clients do not need to authenticate it. The NPS server "authenticates" the access point by virtue of the RADIUS shared secrets.

Finally, this does not need to be a publicly trusted SSL certificate. You can set up an Enterprise CA on your domain, and all computers on the domain will trust it.

Hope this helps!

-Eric