PEAP-MS-CHAPv2 - mobile devices and certificates

Question

I'm looking to secure our wireless infrastructure and CHAPv2 seems to be what we need but I have a couple of concerns.
Our external domain is company.net but our internal domain where the NPS server would sit is domain.company.local
We have a lot of mobile devices - some are on the domain, some are not. 
I'm happy to use an internal certificate or a 3rd party certificate, but given the different domain suffixes, is this going to be possible?  If I use a certificate with subject name domain clients won't trust it.  If I use subject name of company.net,
no clients will trust the NPS server.
How do I get all domain PCs and domain/non-domain mobile devices to trust and connect to the NPS server?

Answer 1

Hi,
When you deploy 802.1X authenticated wireless access that uses PEAP-MS-CHAP v2, RADIUS servers must have digital certificates in order to perform mutual authentication. To issue certificates to your NPS servers you have the option of deploying
a private CA on your network, or purchasing a server certificate from a third party certification authority.
During PEAP-MS-CHAP v2 authentication, the IAS or RADIUS server supplies a certificate to validate its identity to the client. Client computer and user authentication is accomplished with passwords, which eliminates some of the difficulty of deploying certificates
to wireless client computers.
Since user authentication is performed with password-based credentials, not certificates, the certificate which is issued to NPS use the internal domain suffix. But non-domain member computers must have the private CA certificate manually
installed in the Trusted Root Certification Authorities certificate store for them to trust certificates, such as NPS server certificates, that are issued by the private CA.
Besides, are all users in the internal domain? If users are in two domains, you have two options,
Create a two-way forest trust for both sides of the trust.
Install a new NPS server in external domain.
For detailed information, please refer to the link below,
Create a two-way, forest trust for both sides of the trust
http://technet.microsoft.com/en-us/library/cc778851(v=WS.10).aspx
Certificates and NPS
http://technet.microsoft.com/en-us/library/cc772401(v=WS.10).aspx
PEAP-MS-CHAP v2-based Authenticated Wireless Access Design
http://technet.microsoft.com/en-us/library/dd348500(v=WS.10).aspx
Hope this helps.
Steven Lee
TechNet Community Support