NPS Extension Certificate Error

NPS Azure AD Extension Certificate Renewal

The NPS Azure AD Extension creates a self-signed certificate that’s only valid for two years. If you forget to renew it, authentication will eventually start failing when that certificate expires.

Renewal

Renewing the certificate is simple. Just rerun the Azure MFA NPS Extension configuration script:

C:\Program Files\Microsoft\AzureMfa\Config\AzureMfaNpsExtnConfigSetup.ps1

This will generate a new certificate and update the extension to use it.

PowerShell Error

When you run the script, you might see an error like:

The package source https://www.powershellgallery.com/api/v2 is not reachable or resolved.

This usually means PowerShell isn’t using a modern TLS version when it tries to connect to the PowerShell Gallery.

Fix

Windows Server 2016, 2019, and newer support TLS 1.2, but PowerShell may still default to older protocols, depending on .NET and cryptography settings.

The quickest fix is to force TLS 1.2 in your PowerShell session and then rerun the script:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Once TLS 1.2 is enabled, the script can reach the PowerShell Gallery and the NPS Azure AD Extension certificate is renewed without further issues.