Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In other wirds, rather than installing an Enterprise Root CA and having internal PKI. Can I buy a $30 cert from Thawte for example and then use it on my IAS server? Is this not a better and cheaper solution? Thanks folks. Stretched Silly admin

share|improve this question

We do this with our campus 802.1x wireless authentication using eap-ttls.

It also differs from supplicant to supplicant.

Some, such as the native OSX one, require you to select which root CA you use for verifying the radius server's cert. Your users would have to select the proper CA from a dropdown (or perhaps import one if you use a local CA). On the iphone, you have to create a profile using the iphone configuration utility.

I believe there are differences between, for example, the intel and dell wireless supplicants. For instance (looking at intel config right now) there is a check box for "trust any CA" or "specify server or certificate name."

You'll have to test your local situation. But -- the short answer is -- yes, you may use a well-known CA to sign your EAP cert.

share|improve this answer

Well, if you create your own CA and use it to sign a cert for radius/eap, that'll be free, which is a lot cheaper than spending $30.

That's the route I take (that is, I use my own CA) and it works fine. For Windows clients (esp. Vista/Win7), you'll want to copy your CA's public key to the Windows machine and import it, so that Windows will trust the radius/eap cert when connecting to wireless.

Of course, if you spend the money for a Thawte cert, it might be easier to deploy wireless clients as you (probably) don't have to do that CA key import. So it's a matter of how many clients you'll be setting up vs. the $30/year (or whatever it is) cost.

share|improve this answer
This only works well if you control the end stations as well. Otherwise you need to tell the users to trust your ca, and tell them how to import your CA into their supplicant's trusted list of certs. A typical 802.1x wireless distribution assumes that all the systems are windows and on a domain, which simplifies this because you shove the certs into the hosts via a policy. But, in other environments, this isn't a good assumption (that you can modify the end points). – chris Nov 30 '09 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.