Before EAP-TLS can begin, the Windows supplicant must select a client certificate: it must be in the right store (user store for user auth, computer store for machine auth), be within its validity period, chain to a trusted root, include the Client Authentication EKU, and have an accessible private key. If no certificate qualifies, the client fails locally — the RADIUS server never even sees an attempt.
No client certificate found
EAP-TLS: client has no usable certificate
What it means
Common causes
The certificate deployment (SCEP/PKCS profile) failed or has not applied yet, so the store is simply empty.
Certificate is in the wrong store for the authentication mode — user cert but the profile does machine auth, or vice versa.
The certificate lacks the Client Authentication EKU (1.3.6.1.5.5.7.3.2) or the issuing chain is not trusted on the client.
Private key missing or non-exportable key restored without its key (bad imaging/migration practices).
How to fix it
Open
certmgr.msc(user) orcertlm.msc(computer) per the auth mode and confirm a valid cert with Client Authentication EKU and the key icon ('You have a private key that corresponds to this certificate').Check the 802.1X profile's authentication mode (user, computer, or user-or-computer) against where the certificate actually lives.
Fix the upstream deployment: check the Intune SCEP/PKCS profile status for the device before debugging the network side.
If the profile restricts certificate selection (issuer or EKU filters), confirm the deployed certificate matches those filters.