How to verify if a RADIUS server certificate is really validated on Windows 10?

Question

A RADIUS server has a self-signed certificate for radius.example.com. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?)

• The self-signed certificate is installed on all client computers using Group Policy (through Security Settings > Public Key Policies/Trusted Root Certification Authorities).
• In Network Authentication Method Properties (on Wireless Network (802.11) Policies, IEEE 802.1X Settings) validating this certificate is enforced by applying these settings for the SSID:
  • Authentication method: Protected EAP (PEAP)
  • Validate server certificate: Enabled
  • Connect to these servers: radius\.example\.com
  • Trusted Root Certification Authorities: [x] radius.example.com (alone)
  • Do not prompt user to authorize new servers or trusted certification authorities Enabled.

It's assumed that clients wouldn't authenticate against any RADIUS servers not signed by the radius.example.com on any evil twin AP scenarios. However, this is hard to verify from the Windows 10 GUI, as it only says that "Some settings are hidden or managed by your organization" and doesn't show in detail what settings are applied.

What would be the simplest method to verify that client computers are really validating the certificate? RSoP shows that the GPO itself is applied. The certificate is in its place (certmgr.msc).

Answer 1

First idea was to perform the evil twin attack and test, but that would require heavy arrangements. Much easier is to make the existing network temporarily look like a foreign environment. This can be done on the client side:

1. Manually remove the certificate for radius.example.com from the Trusted Root Certification Authorities using the Certificates (Local Computer) Snap-in and create a fake replacement.
2. Try to connect to the wireless network. This should now fail as the certificate verification fails.
3. Using wired network, run gpupdate /force and reboot the computer, if required.
4. The certificate gets reinstalled and the wireless network authentication should work again.

Answer 2

You can check Wi-Fi profile settings in Windows 10 using this workaround: find Wi-Fi adapter (Control Panel\Network and Internet\Network Connections) while connected to your Wi-Fi, right click -> Status -> Wireless Properties.