RADIUS authentification with Microsoft Server 2012 R2 and Sophos UTM 9.5

Hello,

I am new with Sophos products and now I am trying to build a WPA2-Enterprise wireless network with using my credentials from my Active Directory. So I bought a Sophos AP55 and installed the Sophos UTM 9.5 inside a virtual machine (Hyper-V and Windows 10 as host) like I have done it with the Windows Server.

I followed this manual https://community.sophos.com/kb/en-us/115050 after installing AD DC, DNS, DHCP und AD CA -  but unfortunately it doesn't work.

When I try to authenticate with a wireless client the Win 2012 R2 log trows an error "... Certificate isn't trustworthy ...". I tried to manual trust the AD CA-Certificate via the certificates mmc-snapin - it didn't changed anything.

When I enable the PAP-authentification inside the AD tool for users and groups I can test via the Sophos WebAdmin frontend, without a problem. So I guess I made the right configurations but Sophos isn't able to deal with the NPS/CA from Windows 2012 R2. Am I right? Is it a known, common problem? How can I handle this?

Thanks for advice

Freddy