I am trying to authenticate devices onto Wi-Fi using EAP-TLS against NPS.

My PKI and NPS are all part of the same domain but my clients (devices) are on various domains. In my head this should be straight forward - i have a certificate (client auth purpose) on each device (local computer personal certs) that's signed by the intermediate CA, chained up to root CA. I also have both root ca and intermediate ca certs in the devices trusted certs. On NPS I have a server cert (server auth) signed by the same ca and also the root and intermediate ca certs trusted.

I have network and connection request NPS policies set as per: https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS%3A_Creating_a_Policy_in_NPS_to_support_EAP-TLS_authentication

But whatever i try i cant get a device authenticating. In the NPS event log I get a "user does not exist".

Is there something obvious I've missed or am not Getting? Does it matter what the SAN and Subject is for either the client or server certificate?


migrated from security.stackexchange.com Jun 21 at 6:06

This question came from our site for information security professionals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy