802.1x - Computer authentication with multiple certs

Question

My Windows 7 computer has two computer certificates on it set for client authentication. They were issued by different CA's within our environment (it's a unique PKI environment).

In my certificate store I have two computer certs with the same name, but signed by CA-1 and CA-2.

We are also using dot1x. The Radius server trusts CA-2, but not CA-1.

When I go in to the 802.1x settings for my adapter I set it to use 'Computer Authentication', but it does not allow me to select which certificate to use.

The problem is that when I go to authenticate, Windows 7 is automatically trying to use the cert signed by CA-1. I do not know which mechanism Windows uses to make the decision on which certificate to use. The only thing I can guess is that the cert signed by CA-1 is the first in the list because CA-1 is before CA-2 alphabetically.

Is there a way to select which cert is used for 802.1x authentication, or change the process Windows uses?

Answer 1

Hi,

Do let us know if you need any help with other Windows related issues in future.

We will be glad to assist you.

Answer 2

Thank you. I posted this question in TechNet.

Answer 3

Hi,

Thank you for posting your query in Microsoft Community Forum.

As per the description of the issue, I would recommend posting your query in the TechNet Forums. TechNet is looked at by other IT professionals who would more than likely be able to assist you.

TechNet Forum

http://social.technet.microsoft.com/Forums/windows/en-US/home?category=w7itpro

Hope this information is helpful.