The PEAP-MSCHAPv2 auth process is only one way: the server validates the clients user credentials, the client does not. If you don't require the client to validate the server ca cert, then you can't be sure that the 802.1x auth packets you are receiving have been signed by your server.
The scenerio is that you can bring your laptop to Starbucks and I can be there with a 'honeypot' AP wireless card. Your laptop automatically tries to connect to your corporate SSID, my laptop says 'here you are', you send 802.1x credentials, my laptop says 'yeah, whatever', you auth to my laptop, get an IP address, and I issue attacks against your open shares or vulnerabilies on your laptop (which you *DO* have).
Moral of the story, *always* select 'validate server certificate' on the client when using one-way trusted PEAP-MSCHAPv2.
And so we are on the same page, *any* certificate authority can create the cert, it does not need to be the domain controller; that is just a more complicated scenerio because you need MS-IAS or Cisco-ACS to use that cert and MS-AD needs to trust that cert. I bring this up for completeness.
