Extreme Networks

yes, it will work for group membership lookup. The user authentication is part of the offline certificate validation.

we don't promote the NPS servie because we have XIQ-SE NAC scaling much better and have a enterprise great NAC solution.

the pfx extension indicate is a PLCS12 formatted data. Yes it can be used to deploy the certificate for the Radius server.

PEAP-MSCAP is still supported with Windows 11. More and more customer moving to EntraID replacing the classical Active Directory we know since many years. Using EAP-TLS is a good alternative if you know how to deal with client certificates in regards...