How can I configure radius to allow a non-windows device to authenticate with a certificate?

Question

I currently have a 2008r2 server with NPS acting as a radius server for our wireless network.  The existing rules are setup to allow access based on windows group membership.  I need to get a wireless jetdirect connected to the wifi network.  
If I create a certificate for this device with key usage settings for client auth / server auth, can it authenticate to radius with that cert?  
How would I set up a NPS policy to allow this device, since it's not a domain member and not a member of the windows groups?

Answer 1

Hi there -
I asked the NPS team about this, and following is their response:
Yes, it’s possible but it’s a very manual process.  I will give you the easy steps then the hard ones.
Easy(relative):
 Using a domain joined machine, request a certificate from a template that allows the private key to be exported.
Export the cert with the private key
Import on all workstations/devices that require it.
Pros:
Relatively easy to create the cert and manage the account
Cons:
Single certificate used on multiple machines
Certificate does not accurately reflect the name of the device
Hard:
Create an account in AD
Issue a certificate from a template that allows the private key to be exported
Using name mappings, attach the certificate to the account
Create an SPN that matches the SAN on the certificate..i.e. if the SAN is computer.domain.com, you need to create a SPN on the account host/computer.domain.com
Install certificate on to target workstation/device
Pros:
Relatively, more secure than previous steps as you create a single account/certificate pair per device
Cons:
Not very manageable
Thanks -
James McIllece