{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
        "slug": "dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration",
        "url": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/"
        },
        "title": "Update NPS policy certificate bindings after certificate expiration",
        "summary": "How should administrators confirm that each NPS policy references the intended current certificate?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-08T18:14:03+00:00",
        "modified_at": "2026-09-08T18:26:32+00:00",
        "reviewed_on": "2026-09-08",
        "reading_minutes": 1,
        "word_count": 210,
        "potentially_affected": "Administrators maintaining certificate-based NPS authentication policies, distinguishing manual certificate updates from autoenrollment.",
        "dse_recommendation": "Maintain a policy-to-certificate mapping and assign renewal follow-up to the authentication owner.",
        "primary_source": {
            "name": "Manage Certificates Used with NPS",
            "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft states that the server certificate bound to an NPS network policy is not automatically replaced when it expires. An administrator must update each policy using certificate-based authentication to select a current certificate. Until that binding is updated, affected clients cannot authenticate successfully through the policy. Certificate autoenrollment is the exception: it renews the server certificate before expiration, and NPS uses the renewed certificate without a manual policy update. The guidance verifies a binding by comparing its returned thumbprint with the expected certificate in the local computer’s Personal store. <a href=\"https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft documentation</a>.</p>\n<h2>Applicability</h2>\n<p>Inventory the NPS servers, enrollment method, certificate policies, thumbprints, and expiration dates. Confirm whether autoenrollment applies before scheduling manual replacement of a policy selection.</p>\n<h2>DSE recommendation</h2>\n<p>Maintain a policy-to-certificate mapping and assign renewal follow-up to the authentication owner. Keep successful certificate enrollment separate from the policy-binding check. Have the PKI and NPS teams agree on the expected replacement identity before changing production policies.</p>\n<h2>Verification</h2>\n<p>Inspect every affected binding and compare the thumbprint with the approved certificate. Test representative authentication through each policy and record the result and selected certificate identity. Reconcile any policy still referencing an expired certificate before closing the certificate-maintenance task.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Manage Certificates Used with NPS</a>. Source reviewed September 8, 2026.</p>",
        "content_text": "Source facts\nMicrosoft states that the server certificate bound to an NPS network policy is not automatically replaced when it expires. An administrator must update each policy using certificate-based authentication to select a current certificate. Until that binding is updated, affected clients cannot authenticate successfully through the policy. Certificate autoenrollment is the exception: it renews the server certificate before expiration, and NPS uses the renewed certificate without a manual policy update. The guidance verifies a binding by comparing its returned thumbprint with the expected certificate in the local computer’s Personal store. Microsoft documentation.\nApplicability\nInventory the NPS servers, enrollment method, certificate policies, thumbprints, and expiration dates. Confirm whether autoenrollment applies before scheduling manual replacement of a policy selection.\nDSE recommendation\nMaintain a policy-to-certificate mapping and assign renewal follow-up to the authentication owner. Keep successful certificate enrollment separate from the policy-binding check. Have the PKI and NPS teams agree on the expected replacement identity before changing production policies.\nVerification\nInspect every affected binding and compare the thumbprint with the approved certificate. Test representative authentication through each policy and record the result and selected certificate identity. Reconcile any policy still referencing an expired certificate before closing the certificate-maintenance task.\nOfficial references\nMicrosoft Learn: Manage Certificates Used with NPS. Source reviewed September 8, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft states that the server certificate bound to an NPS network policy is not automatically replaced when it expires. An administrator must update each policy using certificate-based authentication to select a current certificate. Until that binding is updated, affected clients cannot authenticate successfully through the policy. Certificate autoenrollment is the exception: it renews the server certificate before expiration, and NPS uses the renewed certificate without a manual policy update. The guidance verifies a binding by comparing its returned thumbprint with the expected certificate in the local computer’s Personal store. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates).\n\n## Applicability\n\nInventory the NPS servers, enrollment method, certificate policies, thumbprints, and expiration dates. Confirm whether autoenrollment applies before scheduling manual replacement of a policy selection.\n\n## DSE recommendation\n\nMaintain a policy-to-certificate mapping and assign renewal follow-up to the authentication owner. Keep successful certificate enrollment separate from the policy-binding check. Have the PKI and NPS teams agree on the expected replacement identity before changing production policies.\n\n## Verification\n\nInspect every affected binding and compare the thumbprint with the approved certificate. Test representative authentication through each policy and record the result and selected certificate identity. Reconcile any policy still referencing an expired certificate before closing the certificate-maintenance task.\n\n## Official references\n\n[Microsoft Learn: Manage Certificates Used with NPS](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates). Source reviewed September 8, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-08"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Update NPS policy certificate bindings after certificate expiration",
                        "item": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
                "url": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/",
                "headline": "Update NPS policy certificate bindings after certificate expiration",
                "description": "How should administrators confirm that each NPS policy references the intended current certificate?",
                "abstract": "How should administrators confirm that each NPS policy references the intended current certificate?",
                "articleBody": "Source facts\nMicrosoft states that the server certificate bound to an NPS network policy is not automatically replaced when it expires. An administrator must update each policy using certificate-based authentication to select a current certificate. Until that binding is updated, affected clients cannot authenticate successfully through the policy. Certificate autoenrollment is the exception: it renews the server certificate before expiration, and NPS uses the renewed certificate without a manual policy update. The guidance verifies a binding by comparing its returned thumbprint with the expected certificate in the local computer’s Personal store. Microsoft documentation.\nApplicability\nInventory the NPS servers, enrollment method, certificate policies, thumbprints, and expiration dates. Confirm whether autoenrollment applies before scheduling manual replacement of a policy selection.\nDSE recommendation\nMaintain a policy-to-certificate mapping and assign renewal follow-up to the authentication owner. Keep successful certificate enrollment separate from the policy-binding check. Have the PKI and NPS teams agree on the expected replacement identity before changing production policies.\nVerification\nInspect every affected binding and compare the thumbprint with the approved certificate. Test representative authentication through each policy and record the result and selected certificate identity. Reconcile any policy still referencing an expired certificate before closing the certificate-maintenance task.\nOfficial references\nMicrosoft Learn: Manage Certificates Used with NPS. Source reviewed September 8, 2026.",
                "datePublished": "2026-09-08T18:14:03+00:00",
                "dateModified": "2026-09-08T18:26:32+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260908-188-update-nps-policy-certificate-bindings-after-certificate-expiration/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Update NPS policy certificate bindings after certificate expiration"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 210,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Manage Certificates Used with NPS",
                    "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-manage-certificates"
                }
            }
        ]
    }
}