RADIUS Wifi and NPS Cert Expired

[speakercon]

I had a BYOD wifi network setup using RADUIS authentication, so users could connect using their AD credentials. This has stopped working, I belive the certificate that was being used has expired (as I think the same cert was being used for something else which stopped working at the same time, but that was been resolved another way). 

 

I also radius for the guest wifi log in (via a splash page) and that is still working. 

 

Abit vague I know, not my specialty area. I'm struggling to find in the NPS settings where you choose a cert to use... 

 

If any experts could point me in the right direction that would be great.

 

 

[StephenPink]

It's on each Network Policy - when you configure the authentication methods. If you then select the auth method, and edit, you then get a drop down to select the certificate to use. I've seen this have issues sometimes when the server has already auto-renewed the certificate in use, but then still had to go into each Network Policy, select the (already selected) renewed certificate and then OK to save it again to "complete" the replacement of the certificate

 

Cheers

[speakercon]

Ah yes okay got them, each policy has a 'protected EAP' but when I click edit it says "a certificate could not be found that can be used with this extensible authentication protocol".

 

Do you think I need to generate a new certificate?

 

1 hour ago, StephenPink said:

It's on each Network Policy - when you configure the authentication methods. If you then select the auth method, and edit, you then get a drop down to select the certificate to use. I've seen this have issues sometimes when the server has already auto-renewed the certificate in use, but then still had to go into each Network Policy, select the (already selected) renewed certificate and then OK to save it again to "complete" the replacement of the certificate

 

Cheers

 

[FragglePete]

I wrote this guide for myself for our NPS Server.  Proved useful as it only happens once a year... I guess documentation is helpful!  Our cert is with GoDaddy, so it'll be different if you use another provider....

1. Snapshot Server 
2. Go to GoDaddy account > My Certificates > <CERTIFICATE NAME> 
3. If the certificate has been renewed (auto-renew), then select IIS from the Download Zip File section.  You should not have to re-key, which involves creating a certificate request if it hasn’t expired. 
4. Extract Certificate to temporary location. 
5. Convert the .crt file to a .cer file. 
6. Locate your downloaded .crt file, and double-click to open it. 
7. Select the Details tab, and then the Copy to File button. 
8. Select Next in the Certificate Wizard. 
9. Select Base-64 encoded X.509(.CER) and then select Next. 
10. Select Browse, locate where you want to save your .CER file, and type in a name for your certificate. 
11. Select Next and then Finished. 
12. Add a Certificate Snap-in to the Microsoft Management Console (MMC) 
13. Click on your Start Menu, then click Run. 
14. In the prompt, type mmc and click OK. 
15. Click File, then click Add/Remove Snap-in. 
16. On the new window, click the Add button. 
17. On the new window, select Certificates and click Add. 
18. Select Computer account for the snap-in and click Next. 
19. Click Local computer and click Finish. 
20. Click Close on the Add Standalone Snap-in window. 
21. Click OK on the Add/Remove Snap-in window. 
22. Import the Intermedia SSL Certificate 
23. In the MCC Console, click ▸ to expand Certificates (Local Computer). 
24. Right click on the Intermediate Certification Authorities folder, hover over All Tasks and click Import. 
25. On the new window, click Next. 
26. Click Browse, find your gd_iis_intermediates.p7b intermediate certificate file and click Open. 
27. Click Next, verify that the certificate information is proper and click Finish. 
28. Close the ‘the import was successful’ notification. 
29. Install the SSL Certificate 
30. Click on your Start Menu, then click Run. 
31. In the prompt, type inetmgr and click OK to launch the Internet Information Services (IIS) Manager. 
32. Under the Connections panel on the left, click on your Server Name. 
33. In the main panel under the IIS section, double click on Server Certificates. 
34. Under the Actions panel on the right, click Complete Certificate Request. 
35. On the new window, click ... to browse, find your previously uploaded primary certificate file and click Open. 
36. Add a Friendly name to easily identify this certificate in the future. 
37. In the certificate store option, select Personal and click OK. 
38. Assign the certificate to NPS Network Policies 
39. Open Network Policy Server Manager 
40. Select Policies > Network Policies 
41. On each of the policies listed, double click then go to the Constraints Tab 
42. Select the EAP Types listed, i.e.. Microsoft: Protect EAP (PEAP) and click Edit 
43. Select the new certificate in the drop down menu, ensuring the expiration date shows the new expiration date on the certificate. 
44. Click Ok then Apply 
45. Do the same for the other Policy listed. 
46.  Stop and Restart the NPS Service  
47.  Test, Test and Test 
48.  Once confirmed all is ok – delete the Checkpoint. 

Hope it helps.

 

Pete

[StephenPink]

17 hours ago, speakercon said:

Ah yes okay got them, each policy has a 'protected EAP' but when I click edit it says "a certificate could not be found that can be used with this extensible authentication protocol".

 

Do you think I need to generate a new certificate?

 

 

 

Just to add to the other reponse as well - not sure if you're using a public or an internal cert but here is what I do for internal cert (names/IPs changed);

 

On your CA create a new template:

 

NPS Server Authentication Template

 

Configured based on Microsoft guidance here: https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-server-certificate-template and https://directaccess.richardhicks.com/tag/certificate-authority/ for the NPS specifics.

Used for server certificates, that are then automatically enrolled and deployed to required servers (NPS)

 

Certification Authority > CA

• Right-click Certificate Templates > Manage
• Select the "RAS and IAS Server Template > Right-click > Duplicate Template:
  • Compatibility:
    • Certification Authority: Windows Server 2016
    • Certificate Recipient: Windows 10/Windows Server 2016
  • General:
    • Template display name: NPS Server Authentication
    • Template name: NPSServerAuthentication
    • Validity period: 5 years
    • Renewal period: 6 weeks
    • Publish certificate in Active Directory: No
  • Subject Name:
    • Supply in the request:
      • Use subject information from existing certificates for autoenrollment renewal requests: Yes
  • Cryptography:
    • Provider Category: Key Storage Provider
    • Algorithm name: RSA
    • Minimum key size: 2048
    • Choose which cryptographic providers can be used for requests:
      • Requests can use any provider available on the subject's computer
    • Request hash: SHA256
    • Use alternate signature format: No
  • Request Handling:
    • Allow private key to be exported: Yes
    • (all else on defaults)
  • Security:
    • Select "DOMAIN\RAS and IAS Servers" and remove
    • Add > "DOMAIN\NPS Servers" and choose the following permissions:
      • Read
      • Enroll
      • Autoenroll
  • OK
• Close Certificate Templates

 

Certification Authority > CA

• Right-click Certificate Templates > New > Certificate Template to Issue
• Select "NPS Server Authentication" > OK

 

 

NPS Server Certificate Request

 

Perform the following steps to request a certificate for the NPS server, that is usable on both NPS Servers.

 

NPS SERVER 1 > Certificate Management Console (certlm.msc) > Personal

• Right-click Certificates > All Tasks > Request New Certificate.

 

This launches the Certificate Enrollment Wizard:

• Before You Begin:
  • Next
• Select Certificate Enrollment Policy:
  • Active Directory Enrollment Policy
• Request Certificates:
  • Select the "NPS Server Authentication" certificate template
  • Click "More information is required to enroll for this certificate"
    • Subject:
      • Subject name:
        • Type: Common name
        • Value: BOTHNPSSERVERS.DOMAIN.LOCAL (to cover both NPS Servers, has to be FQDN)
        • Add
      • Alternative name:
        • Type: DNS
        • Value: BOTHNPSSERVERS.DOMAIN.LOCAL (to cover both NPS Servers, has to be FQDN)
        • Add
        • Type: DNS
        • Value: NPSSERVER1.DOMAIN.LOCAL (to include NPSSERVER1 , has to be FQDN)
        • Add
        • Type: DNS
        • Value: NPSSERVER2.DOMAIN.LOCAL (to include NPSSERVER2 , has to be FQDN)
        • Add
    • General:
      • Friendly Name: NPS Servers
      • Description: Certificate to secure both NPS Servers for failover purposes
    • OK
  • Enroll

 

 

This newly requested certificate then needs exporting, and then importing on NPS SERVER 2 - this is super important; it has to be the exact same certificate with the same thumbprint or else devices will notice the change if there is a failover.

 

NPS SERVER 1 > Certificate Management Console (certlm.msc) > Personal > Certificates

• Right-click the "BOTHNPSSERVERS.SFCF.LOCAL" certificate > All Tasks > Export:
  • Export private key: Yes, export the private key
  • Export file format: Personal Information Exchange - PKCS #12 (.PFX)
    • Include all certificates in the certification path if possible: Yes
    • Delete the private key if the export is successful: No
    • Export all extended properties: No
    • Enable certificate privacy: Yes
  • Security:
    • Password: PASSWORD
    • Encryption: AES256-SHA256
  • File name: CERTIFICATE.pfx

 

 

NPS SERVER 2 > Certificate Management Console (certlm.msc) > Personal

• Right-click Certificates > All Tasks > Import:
  • File name: CERTIFICATE.pfx
  • Private key security:
    • Password: PASSWORD
    • Mark this key as exportable: Yes
    • Include all extended properties: Yes
  • Certificate store: Personal
• Note: This will import the ROOT CA again as well - this extra entry in the Personal store can be removed to reduce confusion