So to create our NPS server certificate, we're going to
duplicate the RAS and IAS server template once more and pretty
much follow many of the same steps here.
So we're going to uncheck Show resulting changes,
choose Windows Server 2016 for our CA and our certificate recipient.
We'll go to the General tab, and we'll give this a different name. Once
again, one year for the validity period is perfectly acceptable, and we
don't need to publish in Active Directory. We'll go to Cryptography, and
we'll choose Key Storage Provider and again bump the Request hash up to
SHA256. Next, we'll go to the Extensions tab. And for our Application
Policies, we're going to click Edit, and we're going to remove Client
Authentication.
Client authentication is not required for the NPS server certificate template.
So we'll click OK, and now we'll go to the Subject Name field.
And here, we're going to build this information from Active
Directory, and we want to select DNS name from the Subject name
format and make sure that DNS name is also selected in the
alternate subject name section here.
Then finally, we'll go to Security, and we will remove the RAS and
IAS Servers group, and we will add our NPS Servers group as well.
And we'll assign them Read, Enroll, and Autoenroll permissions. Once that's done, click OK.