Can you use a public cert to do Radius for EAP?

Question

In other wirds, rather than installing an Enterprise Root CA and having internal PKI. Can I buy a $30 cert from Thawte for example and then use it on my IAS server? Is this not a better and cheaper solution? Thanks folks. Stretched Silly admin

Answer 1

We do this with our campus 802.1x wireless authentication using eap-ttls.

It also differs from supplicant to supplicant.

Some, such as the native OSX one, require you to select which root CA you use for verifying the radius server's cert. Your users would have to select the proper CA from a dropdown (or perhaps import one if you use a local CA). On the iphone, you have to create a profile using the iphone configuration utility.

I believe there are differences between, for example, the intel and dell wireless supplicants. For instance (looking at intel config right now) there is a check box for "trust any CA" or "specify server or certificate name."

You'll have to test your local situation. But -- the short answer is -- yes, you may use a well-known CA to sign your EAP cert.

Answer 2

Well, if you create your own CA and use it to sign a cert for radius/eap, that'll be free, which is a lot cheaper than spending $30.

That's the route I take (that is, I use my own CA) and it works fine. For Windows clients (esp. Vista/Win7), you'll want to copy your CA's public key to the Windows machine and import it, so that Windows will trust the radius/eap cert when connecting to wireless.

Of course, if you spend the money for a Thawte cert, it might be easier to deploy wireless clients as you (probably) don't have to do that CA key import. So it's a matter of how many clients you'll be setting up vs. the $30/year (or whatever it is) cost.