Some laptops reject the RADIUS server and others accept it. The server certificate is signed by an intermediate CA. The laptops that accept it have that intermediate installed, and the others do not. What is missing on the failing laptops?
Select an answer to reveal the explanation.
Short Explanation
The laptops that work have the middle of the chain, and the laptops that fail do not. Install that intermediate on your failing laptops. They do not need the server's private key.
Full Explanation
A certificate chains from the server certificate through any intermediates to a trusted root. These failing laptops do not have the intermediate that signed the server certificate, and the laptops that have it accept the server. Install that intermediate. The server private key stays on the server. Putting it on a laptop would be a compromise, not a fix. A hidden SSID does not install a CA. The data rate does not complete a chain. The server certificate is signed by an intermediate CA. Clients that do not have the intermediate reject it. Clients that have the full chain accept it. Check one live client after the change and leave the rest of the floor alone until that client matches the result you expected. Exam caveat: installing the intermediate in the wrong store, or installing it only for the current user when the service runs as the machine, leaves the chain broken for the supplicant that actually runs. Operational check: install the intermediate the way the working laptops have it, and confirm the failing laptop accepts the server.