802.1X Wireless Machine Certificate based RADIUS Authentication (using NPS) with FortiAP's

Forum|Forum|9 months ago
August 19, 2025
1 reply
3258 views

We have a few new FortiAP's (running FAP 7.4.5) and managed by our FortiGate (running FOS 7.4.8). I would like to allow our laptops to automatically connect and authenticate to our Wi-Fi network using their machine certificates. We have an internal Windows CA and are using Windows NPS as a RADIUS server, is there a guide available to get this working properly on the FortiGate RADIUS and SSID configuration side?

I've been spinning my wheels on this for awhile now. Do the FortiGates/AP's even support EAP-TLS (or EAP-TTLS) or do I have to stick with MS-CHAP-V2? When adding the RADIUS server in the FortiGate, MS-CHAP-V2 seems like the limit.

Thanks!

Best answer by Markus_M

NPS and FortiAP support EAP-TLS. It is not available on the RADIUS server configuration, as EAP is irrespective of the RADIUS configuration and will be encapsulated inside RADIUS messages.
The RADIUS server needs to plainly be added on FortiGate with no specific auth method, or whichever you choose. On SSID side, FortiGate as wireless controller, you select WPA2/3 Enterprise and select the configured RADIUS server object. That is it.

Outside that, you will likely have to set up certificate trust between the Windows workstation and the NPS.
EAP-TLS will have the NPS send its certificate, the client needs to trust it. If so, the client will send its own certificate. NPS needs to trust it. NPS can then validate the content of the user certificate.

There is a guide that may be old, but is quite valid.

https://community.fortinet.com/t5/FortiAP/Technical-Note-EAP-TLS-wireless-LAN-deployment-on-Android-using/ta-p/197717
If you know (!) that the certificates are trusted, keep in mind that in later Windows versions, the client will display a message about you being sure to connect to that SSID.
That would be explained here, it is unrelated to the NPS or hotspot:

https://techcommunity.microsoft.com/discussions/windowsserver/windows-11-clients-cannot-authenticate-to-nps-server-using-computer-authenticati/2827382

Markus_MAnswer

Staff & Editor

NPS and FortiAP support EAP-TLS. It is not available on the RADIUS server configuration, as EAP is irrespective of the RADIUS configuration and will be encapsulated inside RADIUS messages.
The RADIUS server needs to plainly be added on FortiGate with no specific auth method, or whichever you choose. On SSID side, FortiGate as wireless controller, you select WPA2/3 Enterprise and select the configured RADIUS server object. That is it.

Outside that, you will likely have to set up certificate trust between the Windows workstation and the NPS.
EAP-TLS will have the NPS send its certificate, the client needs to trust it. If so, the client will send its own certificate. NPS needs to trust it. NPS can then validate the content of the user certificate.

There is a guide that may be old, but is quite valid.

https://community.fortinet.com/t5/FortiAP/Technical-Note-EAP-TLS-wireless-LAN-deployment-on-Android-using/ta-p/197717
If you know (!) that the certificates are trusted, keep in mind that in later Windows versions, the client will display a message about you being sure to connect to that SSID.
That would be explained here, it is unrelated to the NPS or hotspot:

https://techcommunity.microsoft.com/discussions/windowsserver/windows-11-clients-cannot-authenticate-to-nps-server-using-computer-authenticati/2827382