configured NPS and NPS extension on 2022 server for Citrix netscaler 2FA authentication with Azure entra Account

Hello Aung Nyi Nyi Win

ESTS_TOKEN_ERROR is the result of the NPS Extension's inability to create a secure SSL/TLS connection with Microsoft Entra ID in order to receive an access token. This is a certificate trust/TLS validation failure on the NPS server, not a problem with MFA or NPS logic.

The issue is due to:

• The SSL certificate chain that Entra endpoints utilize is not trusted by the server.
• Outdated or absent root/intermediate certificates TLS inspection (firewall/proxy) changing the certificate Inaccurate TLS setup or system time

To fix the issue try the below:

• Install the most recent Windows updates on the server (to update trusted root certificates).
• Make that the necessary endpoints (like login.microsoftonline.com) can be reached without SSL interception. Verify whether any firewalls or proxies are performing SSL inspection;
• if so, get around them for Microsoft endpoints. Make sure the server has TLS 1.2 enabled.
• Verify that the system's date and time are accurate.
• Verify the existence and validity of trusted root CAs by running certlm.msc.

This is a server-side SSL trust issue, not a configuration problem with MFA itself. Once certificate trust/TLS is fixed, token acquisition will succeed.

Let me know if any further queries - feel free to reach out!

Thanks. How to perform the test all these requirements are passed ? Any Microsoft tool available as we have already enabled TLS 1.2 , certificated are trusted , Skip SSL interception and confirmed date and time are correct.

Hello Aung Nyi Nyi Win

Although there isn't a single "one-click" Microsoft solution for this, you can use built-in and Microsoft-recommended tests to validate everything directly from the NPS server.

• To test the TLS and certificate chain, if fails then the issue is with still certificate trust

Invoke-WebRequest https://login.microsoftonline.com -UseBasicParsing

• Validate that .NET TLS must have Tls12:

[Net.ServicePointManager]::SecurityProtocol

• Ensure that the root CA chain is valid and updated

certutil -verifyctl -urlfetch authroot.stl

• Now, test the connection:

Test-NetConnection login.microsoftonline.com -Port 443

• Enable NPS Extension logs and check event viewer by filtering NPS Extension for Azure MFA
• Bypass the proxy test and retry the authentication:

netsh winhttp reset proxy

If it works → proxy/SSL inspection is still the issue

Hello Aung Nyi Nyi Win

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Hello Rukmini , Thanks. But below command doesn't work and need to change anythings?

certutil -verifyctl -urlfetch authroot.stl