After a hospital RADIUS certificate is reissued by a new CA, laptops reject the server. The new certificate is in date, and the laptops trust only the old CA. What do the laptops need?
Select an answer to reveal the explanation.
Short Explanation
The server brought a badge from a new office, and your laptops still only trust the old office. Install the new CA on the laptops. A faster beacon will not add an issuer to a trust store.
Full Explanation
Clients accept a PEAP or EAP-TLS server certificate only when they trust the issuing CA. This certificate is in date and was reissued by a new CA, and the laptops still have only the old CA, so they reject the server. They need the new CA installed as a trusted issuer. The beacon interval does not add a CA to a laptop. A hidden SSID does not edit the trust store. The data rate does not mark an issuer as trusted during association. Trust is a certificate decision, made before the data rate matters. The RADIUS server certificate was reissued from a new CA. Laptops still trust only the old CA, so they reject an otherwise valid server. Exam caveat: pushing the CA through device management is the scalable version of installing it by hand. A test laptop with a manual install proves the chain, and the rest of the hospital still fails until the same CA is deployed. Operational check: install the new CA on one laptop, join the WLAN, and confirm the server certificate is accepted without a trust warning.