NPS (RADIUS)

This example binds a certificate to the PEAP or EAP network policies of a Network Policy Server (NPS), for example for WLAN, VPN or 802.1X switch authentication. Clients check this certificate during the EAP handshake, so it must be renewed in time on every NPS server. The procedure is the same as for IIS. For a remote NPS server, the management host must reach the server via WinRM, see appendix Appendix: WinRM and SSH setup.

1. Open the tab Deployments of the certificate as described in chapter Local store, switch on Automatic deployment if it is not yet on, and click Add…
2. Linked service: Select NPS (RADIUS).
3. Target host: Click Localhost if NPS runs on the management host, or Browse… to select the NPS server.
4. Credential: For Localhost, no credential is required; the field shows (none / machine account), as TLSPilot works as LocalSystem. For a remote server, select a WinRM credential with local administrator rights on the NPS server.
5. Open the tab Discovery. Under Network Policies, TLSPilot lists all network policies with their order, and for PEAP and EAP policies the certificate currently bound. Policies without PEAP or EAP show No PEAP/EAP configured and cannot be switched on. A saved policy that does not exist on the server shows Not found on target.
6. Switch on the policies whose certificate this deployment should replace. If you know the names, you can also enter them in the tab Manual.

7. Click Test (dry run)… and correct the settings if it reports an error.
8. Click OK and then Save. When asked whether to deploy now, click Yes.

TLSPilot imports the certificate into LocalMachine\My, exports the NPS configuration, replaces the thumbprint in the EAP settings of the selected policies and imports the configuration again. Apart from the thumbprint, the configuration stays byte-identical, so encoding, whitespace and all other settings are kept. It then restarts the NPS service (IAS). The Health check confirms that the EAP settings of the policies and the certificate store contain the new thumbprint.