Probably a little bit confusing, so let me explain the situation.
Our company wants to implement a corporate wireless
PEAP authentication. Unfortunately, someone made a big mistake in our Active Directory design 10 years ago.
The domain name we are using,
company.ch, is not owned by our company, but by someone else. This makes it impossible to issue a public
SSL certificate for the
RADIUS server, and our Active Directory domain is too big to rename.
We already thought about using our private
PKI and rolling out the CA-generated certificate via
GPO but that would only cover our corporate-managed clients, and not any of the devices in our environment from our BYOD policy (Smartphones, Tablets, Laptops..)
Is there a way to add a secondary domain name like
company2.ch, issue a public certificate against it and join
RADIUS to that secondary domain as well, so we can configure that secondary domain via
DHCP for all the client pools?
Or is there another way with, for example, a new
RADIUS server on its own domain (
company2.ch) which is connected with some kind of trust to the
I'm not a client-server guy, but hopefully you get my drift.