Home / server / Questions / 1093956
Accepted
Jasper
Asked: 2022-02-18 01:17:23 +0800 CST

Laptop asking for "action needed" on NPS Computer auth WiFi connect, despite valid Server Thumbprint

  • 772

I have configured computer authentication on WiFi connect to company network, using the microsoft nps server, group policy certificate auto-enrollment and group-policy wifi config. Has been working just fine for several years.

Recently my laptop started showing this prompt upon each reboot/reconnect: "Continue connecting? If you expect to find X in this location, go ahead and connect" Connct prompt

So I checked the server thumbprint in the CA issued certificates, and it matches the thumbprint of the current and valid certificate assigned to the NPS server.

Also, this same certificate (with same expiration date) is configured in NPS server as cert to be used to prove identity: NPS Cert config

Also, the root CA is configured in GPO as trusted root for NPS auth: enter image description here

Furthermore the STL-SVRADMIN-CA is added as a trusted root CA on the laptop showing the action needed prompt: enter image description here

The same cert is used for the IIS server on SVRADMIN which is validated just fine: enter image description here

So the question: Why is this laptop prompting me for a go-ahead? It seems like it should be able to verify the NPS identity by the CA configured and server thumbprint shown in the prompt.

windows-server-2012-r2

0 Answers

  1. Best Answer

    Alright so I found the solution, with some help from @GregAskew for pointing me in the right direction.

    Apparently when you enter the FQDN in the "Protected EAP properties", this FQDN is case sensitive. (Can you believe it?)

    enter image description here

    After i changed the domain suffix from lowercase stl.local to uppercase STL.local, then issued a gpupdate /force and rebooted my laptop, everything worked again as before.

    • 0