NAP (RADIUS) for domain machines and non-domain machines

Hi,

I need your help.
In our organization on DC I installed Network Access Protection service.
We have two-tier CA in our organization.
I added Cisco router as RADIUS client.

Domain computers can connect to network without any problem.

I want to achieve that domain machines and non-domain machines can connect to wireless network only if they have certificate.
I dont know how to setup things so that non-domain machines can connect to network.
What type of certificate we need to use and how to do request on CA for non-domain machines.


Please help.