Event 6273 with reason code 265 — "The certificate chain was issued by an authority that is not trusted." During EAP-TLS (or PEAP with client certificates), NPS built the chain for the client certificate and it terminates in a root that is not in the NPS server's Trusted Root Certification Authorities store (or an intermediate is missing). The client's certificate may be perfectly valid — the server just cannot chain it to a trusted root.
Reason code 265
NPS 6273 reason 265: certificate chain issued by an untrusted authority
What it means
Common causes
Devices get certificates from a new CA (cloud PKI migration!) but the new root/issuing CA certificates were never added to the NPS server's certificate stores.
The intermediate (issuing) CA certificate is missing from the NPS server's Intermediate Certification Authorities store, so the chain cannot be built.
Client sent the wrong certificate (from an old CA or a personal cert) due to loose client-side certificate selection.
How to fix it
On the NPS server, open
certlm.mscand import the root CA certificate into Trusted Root Certification Authorities and any issuing CA certificates into Intermediate Certification Authorities (local machine, not user, store).Verify with the actual client cert: export one failing client certificate and run
certutil -verify client.ceron the NPS server — it must chain cleanly there.During PKI migrations, distribute the new chain to NPS servers before devices start presenting new certificates.
Frequently asked
The client certificate is valid — why does NPS say untrusted?
Trust is evaluated on the NPS server, using its own machine certificate stores. If the issuing CA's chain isn't installed there, every client certificate from that CA is 'untrusted' regardless of how valid it is on the device. Import the root and intermediates on the NPS server.