Renewed my subca now I get A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider

Question

Hello
My subca certificate was about to expire so I renewed it with the same key and since then my wireless will not connect. I get the following error from NPS:
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:
AD\4411CB8CD34A2AA$
Account Name:
host/4411CB8CD34A2AA.ad.***.org
Account Domain:
AD
Fully Qualified Account Name:
AD\4411CB8CD34A2AA$
Client Machine:
Security ID:
NULL SID
Account Name:
Fully Qualified Account Name:
OS-Version:
Called Station Identifier:
f4-1f-c2-e6-0e-40:***-private
Calling Station Identifier:
e0-06-e6-c2-96-b7
NAS:
NAS IPv4 Address:
10.0.2.85
NAS IPv6 Address:
NAS Identifier:
DOM-WLC1
NAS Port-Type:
Wireless - IEEE 802.11
NAS Port:
13
RADIUS Client:
Client Friendly Name:
NPS Proxy 1
Client IP Address:
10.0.2.12
Authentication Details:
Connection Request Policy Name:
Wireless Clients
Network Policy Name:
Wireless Clients
Authentication Provider:
Windows
Authentication Server:
DOM-DC1.ad.****.org
Authentication Type:
EAP
EAP Type:
Microsoft: Smart Card or other certificate
Account Session Identifier:
Logging Results:
Accounting information was written to the local log file.
Reason Code:
295
Reason:
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
How do i make the policy provider trust this new certificate that was created? When i renewed the certificate everything looks good on the subca and root ca. The new certificate is not in the nps servers so i tried manually importing it and that still did
not work. I noticed when i open the wireless network policy properties under constraints and open the Microsoft: Smart Card or other certificate eap type the new certificate is not in there. Any suggestions? Thank you!

Answer 1

can you copy client certificate to NPS server and run the following command against this certificate:
certutil -verify -urlfetch path\clientcert.cer
and show us the output.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.