Shared Chromebooks - Device Certificate Auth NPS - WPA2 Ent

[_techie_]

Hi.

 

We are replacing our Wifi system with Ubiquiti and have some shared chromebooks (acting as Citrix thin clients using Kiosk mode) that I would like to auto connect to the Wifi automatically at boot based on a device certificate.

This method I would also like to be used going forward for any shared iPads and Windows laptops that are school owned and managed.

I have got most of the Ubiquiti system setup including:

1) Wifi Windows VM with Unifi management software running to manage AP's.

2) NPS Server running on MS Server 2016, with successful connections using PEAP/MSChap and an on-prem AD Account to join the Chromebook to the wifi (without a certificate - something I'm not too happy about). The device is joining the appropriate VLAN and gaining an IP and basic transparent proxy internet access (needed to allow me to manage the devices via the Google Admin Console). I have successfully pushed out the MSChap settings from the google admin console to the laptop, and its connecting to the wifi fine.

3) A wildcard certificate on the NPS Server (but no PKI or local CA on-premise).

 

No need to filter the devices per user, as they are connecting to a citrix farm which uses AD based web filtering by smoothwall, post login at our Netscaler.

I am only unsure about what to be using for the identity field for EAP-TLS (and why its required for the device)? I can see the wildcard cert I am using and have assigned to NPS is also being pushed down to the chromebook by the Google Admin Console (its under Chrome://certificate-manager.

I have setup a network policy on NPS that specifies smart-card or certificate but I simply cannot get the Chromebook to connect manually when using the EAP-TLS method. I just get network connection error. The Chromebook isn't domain joined in anyway, only enrolled in the Google Admin console.

 

Any ideas as to what I'm doing wrong?

Thanks