A laptop fails EAP-TLS. The user certificate is in the certificate store and is valid. The supplicant is set to use a smart card, and no smart card is present. What should change?
Select an answer to reveal the explanation.
Short Explanation
The certificate is sitting in the store, and the laptop is looking for a card that is not there. Point your supplicant at the store. Hiding the name will not change where it looks.
Full Explanation
The supplicant offers the credential type it is set to use. This laptop is set to a smart card, no card is present, and a valid certificate is already in the certificate store, so EAP-TLS fails until the supplicant is pointed at that store. The RADIUS server certificate is not what this setting tests. A hidden SSID does not retarget a supplicant. A DHCP lease does not insert a smart card. The supplicant is set to smart card, and the certificate is in the certificate store. It never offers the certificate. Point the supplicant at the certificate. Check one live client after the change and leave the rest of the floor alone until that client matches the result you expected. Confirm the symptom on the next attempt before changing anything else. Exam caveat: after you point at the store, the certificate still has to be one the server trusts. A valid date in the wrong store, or a cert from an untrusted CA, fails the next step. Operational check: select the certificate store, join again, and confirm the laptop offers the user certificate.