NPS client cert expiration catch 22

[ADMaster]

I've found my self in a catch 22. I hope someone here has a fix, or a least something preventive so it doesn't happen next summer.

 

Last year I enabled credential guard which requires certificate authentication to the wifi. I got NPS setup to accept certificates and setup AD CS. All is well certs are issued / renewed everyone can connect.

 

Users have taken laptops home over the summer and the cert expired while off campus. They can't connect because the cert is expired, but they can't renew the cert as they are not connected.

 

The quick fix as folks come in has been to connect via ethernet and reboot to get a new cert.

 

This is fine for a few, but when everyone returns first day of term it will be a nightmare.

 

Suggestions for fixing the current problem and if not, once the cert is renewed how to prevent in future?

 

Thank you

[computer_expert]

Not a definitive answer but how long are the certificates valid for? If 1 year, what about changing it to 2 years within the certificate template (should at least get you through the summer holidays!).

 

edit - what about playing with the renewal period box in the certificate template? (note the certificate will renew at any point between the value here and the expiry date)

Edited August 13, 2019 by computer_expert

[ADMaster]

The certs are 1 year. I thought of 2 years, but isn't that just delaying the problem. If I do either 6 months or 1.5 years I'd end up with the same problem I think. Going far out like 5 years might solve it, because by then they may have reimaged / had a new PC.

What do others do, anyone else encountered this?

Just had another thought, a script with certutil to force renew before summer break?

[computer_expert]

I think a script with something like certutil -renewCert may be your best bet.

 

Longer certificate validity periods (5yr plus) may cause issues when your intermediate/root ca certificate is approaching it's expiry date though.

 

As a preventative thing for next year, you could set up a temporary SSID with a wpa2 passphrase (and ACLs to lock it down to only access your DC(s) & CA) and use something like this to push the new profile out.

[Davit2005]

Can you not use a cert from a CA signing authority and then all you need to make sure is that the root certificate from that authority is in the users devices cert store. These root certs generally last a whole lot longer.

 

We replaced our Radius appliance last year and this is the what we did but I am no expert on certs.

[ADMaster]

@computer_expert I agree the 5 years is too much, I was just brainstorming. @Davit2005 The NPS server cert is fine, the clients do have the root cert, but the client side of the cert has expired.

 

I've come up with the powershell to get the cert expiration info.

get-childitem Cert:\LocalMachine\My\ -ExpiringInDays 90 | where {$_.Issuer -like "*MyrootCA*"} | select subject,notafter,thumbprint

 

I've not found a built in powershell module to renew the cert yet or got the certutil / certreq commands figured out just yet.

My thought is to use the powershell command to get the expiration date, if it expires in 90 days / over the summer then renew. This would be scheduled to run in May.