Run the command netsh wlan show wlanreport.

That drops an html report to C:/ProgramData/Microsoft/Windows/WlanReport/

Look in the Event Viewer

https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/802-1x-authentication-issues-troubleshooting

(Event Viewer (Local) > Applications and Services Logs > Microsoft > Windows > WLAN-AutoConfig > Operational or Wired-AutoConfig > Operational)

For SCEP, look in DeviceManagement-Enterprise-Diagnostic-Provider > Admin

Error: "A Required Certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file"

Solution: Check your system clock. A user reported a difference of only 19 seconds and that was enough to make the installation fail.