NPS certificate present but RADIUS auth still fails on Wi-Fi

Scenario

Wireless or VPN auth fails even though the NPS server has a valid certificate installed.

Confirm NPS is bound to the intended certificate and that the EKU/SAN are appropriate.
Check client trust of the issuing CA and any recent renewal differences.
Compare one successful auth path against the failing one for EAP method mismatch.
If the cert changed recently, verify policy references and trust prompts carefully.

Capture the exact scope of impact, confirm which dependency failed first, and document whether the issue reflects broader domain or server drift.

Subjects