Automated SSL certificate renewal for Network Policy Server (NPS)

NPS hides its RADIUS server certificate inside each network policy. CertKit keeps it current.

Network Policy Server is Microsoft's RADIUS server, and it's what authenticates your 802.1X Wi-Fi, wired network access, and VPN clients with PEAP or EAP-TLS. The server certificate NPS presents during that handshake isn't a named binding. It's stored inside the EAP configuration of each network policy as 14000000 followed by the certificate's SHA1 thumbprint. When the certificate renews the thumbprint changes, the policy still points at the old one, and NPS stops authenticating clients. Every 47 days. On every NPS server you run.

CertKit centralizes certificate issuance and renewal, then pushes the renewed certificate to your NPS servers via the CertKit Agent, rewrites the thumbprint in every affected policy, and restarts the service so RADIUS comes back on the current certificate.

Start free trial Watch demo

Built for Network Policy Server

The pre-built NPS deployment template ships in your CertKit account. No scripting required.

The CertKit Agent imports the renewed PFX, exports the NPS configuration, rewrites the certificate thumbprint inside every EAP policy blob, imports the corrected configuration, and restarts the service. No clicking through each network policy in the NPS console, no re-selecting the certificate by hand, no silent authentication outage waiting to be discovered.

Restarting the NPS service drops RADIUS for a moment, so in-progress authentications retry and clients re-associate as the listener comes back. Schedule a deployment window per server so the thumbprint update and restart run at 2am Sunday rather than during business hours. CertKit stages the renewed certificate and only applies it inside the window you choose.

The pre-built NPS template ships with your CertKit account. Enable it once. CertKit handles every renewal after that.

How to install a server certificate on NPS

The manual process, if you want to do it yourself:

Get a certificate that meets the NPS server certificate requirements. PEAP and EAP-TLS need the Server Authentication EKU, a subject your clients trust, and a chain to a CA in their trust store. A certificate that misses any of these authenticates nobody.
Import it into the computer store. Local Machine → Personal on the NPS server, with the private key.
Re-select the certificate in every network policy. In the NPS console, open each policy that does PEAP or EAP-TLS, step into the EAP properties, and pick the renewed certificate. Importing alone changes nothing: the policy pins the old thumbprint until you re-select.
Restart the service. NPS presents the new certificate on the next 802.1X or VPN authentication after a restart.
Repeat everywhere. Every policy, on every NPS server, including the secondary RADIUS hosts nobody remembers until Wi-Fi fails over to them.

Every one of these steps is manual, and NPS won't repeat any of them for you when the certificate renews. With lifetimes shrinking to 47 days, installation stops being an annual chore and becomes a recurring task: eight times a year, across every policy and server. Miss one and Wi-Fi authentication fails.

At 47 days, automation is the only sustainable way to run RADIUS server certificates. Here's how CertKit does it.

How it works

            Your NPS / RADIUS server
┌──────────────────────────────────────────┐
│  ┌─────────────┐                         │
│  │CertKit Agent│──┐ 1. import PFX        │     CertKit
│  └─────────────┘  │    -> LocalMachine   │   ┌──────────┐
│         │         ▼                      │◄──┤ Issue &  │
│         │   ┌───────────────┐            │   │ Renew    │
│         │   │ Cert store    │            │   │   ┌───┐  │
│         └──►│ NPS EAP config│  2. patch  │   └───│DNS│──┘
│   3. netsh  │ 14000000+ref  │     thumb  │       └───┘
│   import    └───────┬───────┘            │  one-time CNAME
│         ┌───────────▼───────┐            │  delegated DNS
│         │ IAS svc restarted │ 4. restart │
│         │ [x] PEAP online   │            │
│         └───────────────────┘            │
└──────────────────────────────────────────┘

CertKit manages issuance and renewal centrally using delegated DNS validation. You create a one-time CNAME record and CertKit handles every ACME challenge after that. The NPS server never runs an ACME client and never holds DNS credentials, the agent imports the certificate, rewrites the thumbprint inside the EAP config, and restarts the service locally.

CertKit is an invaluable tool for administrators managing public TLS certificates in Microsoft environments like Always On VPN (SSTP) and DirectAccess (IP-HTTPS), as it simplifies and fully automates Let's Encrypt certificate issuance and renewal. CertKit eliminates the security risks and complexities of manual DNS challenges or API key exposure.

Richard Hicks, Consultant and Microsoft MVP

What CertKit handles

Issue the RADIUS server certificate via ACME, centrally. PEAP and EAP-TLS need a server certificate that clients trust and that carries the Server Authentication EKU. Your NPS server doesn't need an ACME client, no credentials, and no open ports.
Rewrite the thumbprint, not just import the cert. This is the step manual renewals miss. CertKit updates the 14000000 + thumbprint reference inside each EAP policy so NPS actually uses the renewed certificate instead of failing against a stale binding.
Cover every network policy on the server. A single NPS box can carry separate policies for Wi-Fi, wired 802.1X, and VPN, each with its own EAP certificate reference. CertKit patches all of them in one pass instead of leaving one behind.
Restart the service cleanly. The agent imports the corrected configuration and cycles the NPS service so the new certificate is presented on the next authentication, then confirms RADIUS is answering.
Deploy in a window you control. The service restart briefly interrupts RADIUS, so it shouldn't fire mid-workday. Schedule a deployment window per server and CertKit applies the thumbprint update and restart at 2am Sunday instead of whenever the certificate renews.
Verify the deployment, not just the script. After each renewal, CertKit confirms the new certificate is the one NPS now presents, checking serial number, SANs, and expiry. A thumbprint that didn't take is caught here, before users fail to connect to Wi-Fi or VPN.
Alert on failure. Config-rewrite failures, service restart errors, verification mismatches, and upcoming expirations all generate alerts before they become an outage.
Audit every change. Every issuance, renewal, and thumbprint update is logged with timestamp, certificate, and server. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit. Every renewal challenge after that is automatic.
Install the CertKit Agent on the NPS server. One command on the Windows Server running the Network Policy Server role. The agent runs as a Windows service and needs no inbound firewall rules.
Add the NPS deployment script. The pre-built template is in your account. Save it and CertKit imports the certificate, rewrites the EAP thumbprint, and restarts the service on every renewal.

See the full architecture →

Why importing the certificate isn't enough

With most Windows services, importing a renewed certificate and rebinding by thumbprint is the whole job. NPS is different because the certificate is selected inside the EAP configuration of each network policy, recorded as 14000000 plus the SHA1 thumbprint. Drop a new certificate into the store and NPS keeps presenting the old thumbprint, finds it no longer matches anything usable, and rejects PEAP and EAP-TLS authentication. The certificate is valid and present, the service is running, and clients still can't get on the network, which makes it a confusing outage to diagnose.

CertKit issues the RADIUS certificate via delegated DNS validation, then the agent handles the thumbprint rewrite, the import, and the restart as one verified step. There is no ACME client on the server and no console clicking on your renewal calendar.

NPS is the RADIUS server behind your Wi-Fi and VPN

The certificate NPS presents for PEAP and EAP-TLS is the trust anchor your 802.1X Wi-Fi, wired network access control, and Always On VPN authentication all depend on. CertKit automates that certificate, plus the gateway certificates on Always On VPN, DirectAccess, RRAS, IIS, SQL Server Reporting Services, and AD FS, from a single account.

See all integrations

Start automating NPS certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing