In PEAP and EAP-TLS the client validates the RADIUS server's certificate before sending any credentials. Windows' UI hides this behind the generic "Can't connect to this network" message. If the 802.1X profile enforces server validation (it should), the connection dies when the server certificate's root is not trusted by the client, or its name does not match the names the profile allows.
Can't connect to this network
Client rejects the RADIUS server certificate ('Can't connect to this network')
What it means
Common causes
The Wi-Fi/wired profile pins specific trusted root CAs or server names, and the NPS/RADIUS certificate was renewed or replaced with one that no longer matches — the classic morning-after-cert-renewal outage.
The RADIUS server certificate chains to a root that is not deployed to clients (common when moving RADIUS to a new PKI or cloud provider).
The profile's 'Connect to these servers' entry doesn't match the new certificate's subject/SAN.
The server certificate is expired or lacks the Server Authentication EKU.
How to fix it
Compare the RADIUS server certificate (issuer, SAN names, expiry) with the deployed 802.1X profile settings (trusted roots and server names) — update the profile via Intune/GPO when the certificate changes.
Deploy the new root CA certificate to clients (Intune trusted certificate profile) before switching the RADIUS server certificate.
Do not train users to click through trust prompts or disable server validation — fix the profile instead; unvalidated 802.1X invites credential-stealing evil-twin APs.
Check the client-side details in Event Viewer > Applications and Services Logs > Microsoft > Windows > WLAN-AutoConfig for the reason behind the generic UI message.
Frequently asked
Why did the whole fleet stop connecting to Wi-Fi after we renewed the NPS certificate?
Your 802.1X profile validates the server certificate against pinned roots/names. A renewed or re-issued certificate that changes issuer or subject breaks that validation on every client at once. Update the profile (or issue a certificate matching the pinned values) and push it before the old certificate expires.