topic Win7 not accepting cert from NPS in Network Access Control

Win7 not accepting cert from NPS

CSCO10662744_2 — Mon, 11 Mar 2019 06:46:32 GMT

An environment I'm working on has Cisco WLC, MS NPS RADIUS server, and some clients doing WPA2-Enterprise authentication.
For some reason, all the endpoints work, except Win7 clients.

With either self, or public signed certs, Win7 would prompt for username/password, but after clicking OK, authentication would fail.

Win7 does NOT prompt for user to accept cert, while NPS has a log saying cert is not trusted.
Why would Win7 not prompt for user to accept cert, and how do we enable that prompt?

Is this an NPS-specific issue?
If we use ISE to do RADIUS auth in the backend, would this issue go away?

It sounds like the Windows 7

Philip D'Ath — Tue, 17 May 2016 05:51:35 GMT

It sounds like the Windows 7 machines are missing the CA certificate that was used to issue the NPS certificate used for the PEAP authentication.

Thanks for the reply.

CSCO10662744_2 — Thu, 19 May 2016 18:31:04 GMT

Thanks for the reply.

In the past, even when the CA cert is not in the trust store, Win7 would still prompt user w/ a warning, and user still had a choice to accept/deny.

In this case, the user doesn't even get prompted.

We changed the CN in cert, and created a DNS entry, and somehow that made Win7 clients to start prompting users now.

I was curious to know why Win7 didn't prompt, and if this is a specific behavior when NPS s used as RADIUS server.