Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When attempting to connect to our company wireless while not on the domain, I receive a message saying that our RADIUS server provided a valid certificate issued by our root CA, but that the root CA is not configured as a valid trust anchor (on a windows 7 machine).

The root CA has to be manually checked off under security for the wireless network connection in order to remove this message. What is the point of manually telling the system to trust the Root CA? Isn't that the point of having a trusted root CA? Is there any way around this? It becomes an issue when users think our connection is insecure or certificates are out of date. I can't manually configure every machine that may use the wireless.

It's the same as the issue seen here.

share|improve this question

1 Answer 1

Think about your question for a second.

The "root CA" is the "root CA" for your domain. So yes, it will be trusted by members of your domain, and not by machines that aren't joined to your domain. In fact, if you could get machines to automatically, arbitrarily trust your CA, that would be a rather big security hole rather than a security feature (and is precisely how Stuxnet and Flame installed themselves - with forged certificates from universally trusted CAs).

You should be distributing certificates and CA trusts through GPO, (auto-enrollment) which means you don't have to manually configure every machine that needs to use the wireless, and you can make your life a lot easier by only allowing domain-joined machines (that have those certificates and trusts pushed out to them) onto the company wireless network, precisely so you don't have to manually issue certs and trusts. Of course, you can decide to allow any device that doesn't have the trusts and certificates to use the wireless... but the symptoms you're seeing is the price you pay for doing so.

You can also set up a secondary wireless SSID, protected with a password and segmented off from the corporate network to allow your users to surf the web with their personal devices (and is what we do), if you can't lay down the law and just say "no" to personal wireless devices at the office.

share|improve this answer
It seems my understanding of certificate trust is lacking. I should add that I am in tier one support for a large company serving users who cannot join the domain, so we can't push the trust profile via GPO. The certificate is validated by a trusted CA, which from my understanding, is already in most up to date windows computers' certificate store. –  zach Aug 24 '12 at 13:54
@zach In that case, you may want to look into generating a script that checks for the presence of that CA trust (which is stored as an object in the machine/device certificate store), creates it if not present and then checks for a valid certificate signed by that CA, and pushes one out if not found. A lot easier than dealing with users and manually screwing around with adding certificates and such through the GUI. I'll update my answer with a screenshot of the trusted CAs in one of my default Windows installations (VM) so you can see if your CA is actually trusted by default. –  HopelessN00b Aug 24 '12 at 14:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.