Certificate-based 802.1X authentication fails for all or many clients.
Likely causes
- Expired RADIUS certificate
- Untrusted PKI chain
- Unreachable CRL
- Changed RADIUS policy
Checks in priority order
- Read RADIUS logs
- Check server certificate and EKU
- Test revocation
- Compare with a previously successful authentication
When to escalate
Escalate when the failure affects multiple users, a production dependency is unavailable, or logs show a component outside your control. Include timestamps, scope, tests already performed, and the last known working state.