Error "one of the CA certificates is not trusted by the policy provider"

I am trying to set up 802.1x authentication for a wireless
lan rollout using 802.1x with Windows 2003 server running
IAS and a Stand-Alone CA.

To be clear, I am using the same Windows 2003 server as
both an IAS server and stand-alone certificate authority.

I installed a computer certificate for IAS on the server,
requesting a Server Authentication certificate and "RSA
SChannel" for the CSP option, storing the cert in the
local computer certificate store.

In IAS, I set up a Wireless remote access policy via the
wizard. I chose "Smart card or other certificate" for an
EAP Provider. Editing that provider selection allows me
to verify that it's using the aforementioned server
authentication certificate.

The wireless access point is set up to use this server as
the Radius server.

On the client, I plugged in to the wired lan and requested
a client authentication certificate, leaving every option
at the default. When I installed that certificate, I was
prompted to add the Windows 2003 server to my Trusted Root
store, which I approved. I then unplugged from the wired
lan and plugged in my wireless adapter (for which I've
already loaded the drivers and configured for 802.1x).
I'm prompted to choose a certificate to use for the
connection, I then select the Client Authentication
certificate, the network connection quickly show a status
of "Validating Identity" and then I'm prompted to select
the certificate again.

On the server's event viewer, for IAS I get a single error
per attempt: "A certification chain processed correctly,
but one of the CA certificates is not trusted by the
policy provider."

I'm assuming that the Root CA certificate is the one I
find on the CA itself, issued by itself, to itself and
valid for "All issuance policies" and "All application
policies". I've tried installing that certificate in the
user and computer "Trusted Root Certification Authorities"
on the client and the server, to no avail.

Which machine is not trusting the CA certificate, the
server or the client? What piece am I missing?

Paul -

I'm pursuing something very similiar in
microsoft.public.internet.radius. See the discussion
there. It may help you.

Mark



>-----Original Message-----
>I am trying to set up 802.1x authentication for a
wireless
>lan rollout using 802.1x with Windows 2003 server
running
>IAS and a Stand-Alone CA.
>
>To be clear, I am using the same Windows 2003 server as
>both an IAS server and stand-alone certificate
authority.
>
>I installed a computer certificate for IAS on the
server,
>requesting a Server Authentication certificate and "RSA
>SChannel" for the CSP option, storing the cert in the
>local computer certificate store.
>
>In IAS, I set up a Wireless remote access policy via the
>wizard. I chose "Smart card or other certificate" for
an
>EAP Provider. Editing that provider selection allows me
>to verify that it's using the aforementioned server
>authentication certificate.
>
>The wireless access point is set up to use this server
as
>the Radius server.
>
>On the client, I plugged in to the wired lan and
requested
>a client authentication certificate, leaving every
option
>at the default. When I installed that certificate, I
was
>prompted to add the Windows 2003 server to my Trusted
Root
>store, which I approved. I then unplugged from the wired
>lan and plugged in my wireless adapter (for which I've
>already loaded the drivers and configured for 802.1x).
>I'm prompted to choose a certificate to use for the
>connection, I then select the Client Authentication
>certificate, the network connection quickly show a
status
>of "Validating Identity" and then I'm prompted to select
>the certificate again.
>
>On the server's event viewer, for IAS I get a single
error
>per attempt: "A certification chain processed correctly,
>but one of the CA certificates is not trusted by the
>policy provider."
>
>I'm assuming that the Root CA certificate is the one I
>find on the CA itself, issued by itself, to itself and
>valid for "All issuance policies" and "All application
>policies". I've tried installing that certificate in
the
>user and computer "Trusted Root Certification
Authorities"
>on the client and the server, to no avail.
>
>Which machine is not trusting the CA certificate, the
>server or the client? What piece am I missing?
>
>
>.
>