T48G v80 with 802.1X - Certificate chain error

[kris_k]

Hi,

We've bought a T48G to evaluate for deployment and so far cannot get the device to authenticate against the Cisco switches (3850's) using 802.1x. The phone is using firmware 35.80.0.130. The 802.1x related settings are as follows:

network.802_1x.identity = username
network.802_1x.md5_password = abc1234....
network.802_1x.mode = 3
network.802_1x.ca_file_name = Certificates.pem

This setting doesn't work either...
security.trust_certificates = 0

The pem file contains the intermediate and root cert of the public CA used for the radius cert. This cert chain is verified with the openssl cli tool. This chain also exists on the radius server and is correctly installed.

The radius server is NPS on Windows 2012R2. The event log contains the following error:
Authentication Type: PEAP
EAP Type: -
Account Session Identifier: -
Logging Results: Accounting information was written to the local log file.
Reason Code: 265
Reason: The certificate chain was issued by an authority that is not trusted.

As far as I can tell, this configuration should be fine for the phone. Is there something I'm missing?

Cheers,

Kris