I have recently deployed CA and NPS for WPA2-Enterprise authentication. However doing the pen testing I found out that clients are accepting a certificate from any valid certificate authority. This is potentially as you all know opening us to a MiTM attacks as the attacker can provide any certificate provided with the public certificate authority. How I would like it to work is, that I would force all clients with a GPO to trust only certificate generated by our internal CA for WiFi authorization. Server running CA is Windows 2016 Server running NPS is Windows 2008 Clients are Windows 10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.