I am trying to authenticate devices onto Wi-Fi using EAP-TLS against NPS.
My PKI and NPS are all part of the same domain but my clients (devices) are on various domains. In my head this should be straight forward - i have a certificate (client auth purpose) on each device (local computer personal certs) that's signed by the intermediate CA, chained up to root CA. I also have both root ca and intermediate ca certs in the devices trusted certs. On NPS I have a server cert (server auth) signed by the same ca and also the root and intermediate ca certs trusted.
I have network and connection request NPS policies set as per: https://documentation.meraki.com/MR/Encryption_and_Authentication/RADIUS%3A_Creating_a_Policy_in_NPS_to_support_EAP-TLS_authentication
But whatever i try i cant get a device authenticating. In the NPS event log I get a "user does not exist".
Is there something obvious I've missed or am not Getting? Does it matter what the SAN and Subject is for either the client or server certificate?