Both sides of EAP-TLS may check the peer certificate's revocation status. NPS checks the client certificate's chain against CRLs; if the CRL distribution point is unreachable from the NPS server, or the CRL has expired, validation fails and the connection is rejected — with revocation-related text in the event's reason — even though every certificate involved is valid and unrevoked. This bites hard in cloud PKI migrations where CDP URLs move.
Revocation check failure
EAP-TLS fails because certificate revocation cannot be checked
What it means
Common causes
The CRL URL in the client certificates is unreachable from the NPS server (internal-only CDP, proxy without server egress, decommissioned web server).
The CRL is expired because publication lapsed on the issuing CA.
Certificates issued by a CA with an LDAP-only CDP, which cloud-issued or DMZ servers cannot resolve.
How to fix it
On the NPS server, run
certutil -verify -urlfetch client.ceragainst an exported failing client certificate — it shows exactly which CDP/OCSP fetch fails.Fix reachability: allow outbound HTTP from NPS servers to the CDP host, or publish the CRL somewhere NPS can reach.
Keep CRLs current on the issuing CA (
certutil -crl) and monitor Next Update dates so expiry never surprises you.When migrating PKI, ensure new certificates carry HTTP CDP URLs reachable from every RADIUS server that must validate them.