@fjulianomObviosly the client gets a warning and must accept since doesn't have the certificate, but the client also gets a warning in case EAP offload is not used and it doesn't have the RADIUS certificate. - This is only obvious when you don't have it setup correctly. When setup right there is no accepting a certificate from the client, I made the assumption this wasn't the case. Makes sense now that your having the client manually accept the cert. Most people do not set it up this way for two reasons, security and they want it to be seamless to the end user. To make it seamless you push the server cert out to the clients via GP so they do not get the message your referring to.I can elaborate more on security but just keep in mind quite a bit of malware uses the same techniques on accepting a unknown cert. This is why most browsers have built in mechanisms to protect against certificates expired, unknown, etc. If your clients are used to accepting the certificate and ok with it then the process doesn't change when you go to EAP offloading and don't push each APs cert out. If you did not want the clients to accept the certificate you could export all of the APs certificates and push them out. Microsoft - https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/wireless/a-deploy-8021x-wireless-access See- To successfully authenticate the NPS, the client computer must trust the CA that issued the NPS certificate. The client trusts this CA when the CA’s certificate is present in the Trusted Root Certification Authorities certificate store on the client computer. If you deploy your own private CA, the CA certificate is automatically installed in the Trusted Root Certification Authorities certificate store for the Current User and for the Local Computer when Group Policy is refreshed on the domain member client computer. If you decide to deploy server certificates from a public CA, ensure that the public CA certificate is already in the Trusted Root Certification Authorities certificate store.
... View more
