NPS Certificate WPA3-Enterprise

[kyle141]

Hi All

 

Has anyone setup a NPS network policy with a trusted CA certificate. I'm currently using a self signed cert from my internal CA.

The issue is my internal domain and external domain don't match. See below

 

Internal: *.ad.fXXXXXX.hXXXX.sch.uk

External: fXXXXXXX.hXXXX.sch.uk

 

Its for a BYOD network using PEAP as the authentication method and MSCHAP-V2

 

Does anyone have any advise on this. With Android not letting users check the do not validate certificates option its getting more difficult to get users on the BYOD network.

 

Thanks

[wright-fi]

You can add additional names to your NPS Server:

 

NETDOM COMPUTERNAME *.ad.fXXXXXX.hXXXX.sch.uk /ADD fXXXXXXX.hXXXX.sch.uk

NETDOM COMPUTERNAME *.ad.fXXXXXX.hXXXX.sch.uk /ENUM

 

The first command adds the name and the second command prints all names.

 

As you're using a self signed cert, BYOD users won't recognise your CA. So you would have to manually install the cert on each BYOD device (not ideal) or use a cert from a trusted certificate authority (such as GoDaddy).