Required certificates The following table identifies the certificates that are required to successfully deploy each of the certificate-based authentication methods. Required for EAP-TLS and Required for Certificate Details PEAP-TLS? v2? Yes. The CA certificate CA certificate in is enrolled Yes. The CA certificate is For the Trusted Root automatically for enrolled automatically for v2, The CA Certification domain member domain member computers. certificate is Authorities computers. For For non-domain member required for mutual certificate store member computers, the certificate authentication for Local computers, the must be manually imported between client and Computer and certificate must be into the certificate store. server. Current User. manually imported into the certificate store. Yes. Client computer certificates are required unless user certificates are distributed on smart cards. If you deploy user No. User authentication Client computer Client certificates are certificates on smart is performed with certificate in the enrolled automatically for cards, client password-based certificate store of domain member computers. computers do not credentials, not the client. For non-domain member need client certificates. computers, the certificate certificates. must be manually imported or obtained by using the Web enrollment tool. Yes. In addition to The NPS server Yes. You can configure using AD CS for server sends the server Server certificate AD CS to autoenroll server certificates, you can certificate to the in the certificate certificates to members of the purchase server client computer; the store of the NPS RAS and IAS servers group certificates from other client computer uses server. in Active Directory Domain CAs that client the certificate to Services (AD DS). computers already authenticate the NPS trust. server. For EAP-TLS and No. This certificate is No. User authentication PEAP-TLS, if you required only if you choose to is performed with do not autoenroll User certificate deploy smart cards rather password-based client computer on a smart card. than autoenrolling client credentials, not certificates, user computer certificates. certificates. certificates on smart cards are required.
Required certificates The following table identifies the certificates that are required to successfully deploy each of the certificate-based authentication methods. Certificate Required for EAP-TLS and PEAP-TLS? Required for v2? Details CA certificate in the Trusted Root Certification Authorities certificate store for Local Computer and Current User. Yes. The CA certificate is enrolled automatically for domain member computers. For non-domain member computers, the certificate must be manually imported into the certificate store. Yes. The CA certificate is enrolled automatically for domain member computers. For member computers, the certificate must be manually imported into the certificate store. For v2, The CA certificate is required for mutual authentication between client and server. Client computer certificate in the certificate store of the client. Yes. Client computer certificates are required unless user certificates are distributed on smart cards. Client certificates are enrolled automatically for domain member computers. For non-domain member computers, the certificate must be manually imported or obtained by using the Web enrollment tool. No. User authentication is performed with password-based credentials, not certificates. If you deploy user certificates on smart cards, client computers do not need client certificates. Server certificate in the certificate store of the NPS server. Yes. You can configure AD CS to autoenroll server certificates to members of the RAS and IAS servers group in Active Directory Domain Services (AD DS). Yes. In addition to using AD CS for server certificates, you can purchase server certificates from other CAs that client computers already trust. The NPS server sends the server certificate to the client computer; the client computer uses the certificate to authenticate the NPS server. User certificate on a smart card. No. This certificate is required only if you choose to deploy smart cards rather than autoenrolling client computer certificates. No. User authentication is performed with password-based credentials, not certificates. For EAP-TLS and PEAP-TLS, if you do not autoenroll client computer certificates, user certificates on smart cards are required.
Windows%20Server%202016%20Network%20Policy%20Server%20Technical%20Reference.docx