NPS, Third Party Certs and Pixel phones issues.

[NegativeKillDeath]

As we know Google have tightened up their WPA2 enterprise WiFi connection by removing the 'do not valid' option. We purchased a third party cert for the NPS server, installed it and set it as the cert that gets used by PEAP. Some phones such as my Samsung S22 ultra will allow a connection to the WiFi by selecting Use System Certificates in the options. Other devices can be a bit different. A Samsung A05s we have, when connecting to wifi during setup, tells me the CA cert is invalid. If I use the Trust On First Use option it presents the certificate for me to agree to, this is the correct certificate issued by the intermediate cert. I suspect it isn't validating the whole chain and therefore rejecting it. If I skip the wifi during set up and connect at a later date the Use System Certificate option just works. 

 

If I check the cert on the server it has the full chain listed, signed by RapidSSL in turn signed by DigiSign CA. It is a server specific cert, not a wild card. 

 

Everything looks in place for it to work its just Pixels and this odd Samsung during set up where it falls down. Any pointers on where to look next would be appreciated.