Knowledge Base

How is the Server Certificate installed on Microsoft Network Policy Server (NPS) on Windows 2019 Server?

Updated on October 22, 2026

Overview

This article explains how to install and apply a server certificate in Microsoft Network Policy Server (NPS) on Windows Server 2019. Use this procedure when NPS must use a server certificate for secure network authentication, including environments that use EAP-based authentication methods such as PEAP.

What Is a Server Certificate in Microsoft NPS?

Microsoft Network Policy Server (NPS) uses a server certificate to identify the NPS server during authentication requests. When EAP-based authentication methods are used, client devices validate the server certificate before trusting the NPS server. Selecting the correct certificate helps protect certificate-based authentication and reduces certificate trust warnings during network access.

Prerequisites

Administrator access to the Windows Server 2019 machine.
The server certificate is already installed on the server and visible in the certificate store.
The Network Policy Server (NPS) role is installed and accessible on the server.
The certificate intended for NPS use is available in the certificate selection list during PEAP/EAP configuration.

Steps

Step 1: Open Network Policy Server

Open the Network Policy Server console by navigating to Windows Icon > Administrative Tools > Network Policy Server. You can also open it from Server Manager > Tools > Network Policy Server.

Figure 1. Opening Network Policy Server from Administrative Tools

Figure 2. Opening Network Policy Server from Server Manager

Step 2: Navigate to Network Policies

When the NPS console opens, go to Policies > Network Policies. The configured Network Policy profiles appear in the right pane.

Figure 3. Viewing Network Policy Profiles.

Step 3: Open the Policy Properties

Double-click the required Network Policy profile. You can also right-click the policy and select Properties to open the policy settings.

Figure 4. Opening Policy Properties

Figure 5. Network Policy Properties Window

Step 4: Edit the EAP Authentication Method

Select the Constraints tab, then click Edit for the configured EAP type. This opens the Edit Protected EAP Properties window.

Figure 6. Editing Protected EAP Settings

Step 5: Select the Server Certificate

In the Edit Protected EAP Properties window, select the appropriate certificate from the Certificate issued to dropdown list.
Confirm the selected certificate is the intended server certificate.
Click OK, then click Apply to save the configuration.

Figure 7. Selecting the NPS Server Certificate

Step 6: Restart NPS

Stop the Network Policy Server service.
Start the Network Policy Server service again so the selected certificate is applied.

Figure 8. Stopping the NPS Service

Figure 9. Starting the NPS Service

How to Verify Success

Reopen the EAP properties for the Network Policy and verify that the selected certificate is still displayed in the certificate dropdown.
Test authentication from a client device and confirm certificate-based authentication succeeds without certificate warnings.

Troubleshooting

Issue	Possible Cause	Resolution
Certificate does not appear in the certificate dropdown	The certificate may not be installed in the correct certificate store, may not include a private key, or may not be suitable for the EAP authentication method.	Confirm that the certificate is installed on the server and visible in the correct certificate store. Verify the certificate includes the required private key and usage attributes before retrying the NPS selection.
Authentication fails after selecting the certificate	The wrong certificate may have been selected, or the service may not have loaded the updated configuration.	Reopen the EAP properties, confirm the selected certificate, apply the configuration, and restart the NPS service.
Client devices show certificate trust warnings	The client may not trust the certificate chain.	Confirm that the required root and intermediate certificates are trusted by client devices.
NPS configuration appears unchanged after saving	The NPS service may not have restarted after the certificate was selected.	Stop and restart the Network Policy Server service, then verify the selected certificate again.

Frequently Asked Questions

1) Why does the server certificate need to be installed before configuring NPS?

The certificate must be available on the Windows Server before NPS can select it in the EAP authentication method configuration.

2) Why does the certificate not appear in the NPS dropdown?

The certificate may not be installed in the correct certificate store, may not include a private key, or may not meet the requirements for the authentication method. Confirm the certificate installation and retry the selection.

3) Do I need to restart NPS after selecting the certificate?

Yes. Restarting the Network Policy Server service ensures the selected certificate is applied to the running service.

4) How can I confirm if the certificate is working?

Reopen the EAP properties and confirm that the selected certificate remains in the dropdown. Then test authentication from a client device and confirm that certificate-based authentication succeeds without warnings.