0

Consider an environment that uses 802.1x PEAP authentication via RADIUS. Typically, this is to authenticate wireless clients.

In this environment there are multiple RADIUS servers and clients will be served by whichever is available.

I have seen two approaches with regard to the server certificate presented to clients.

In the first, the same certificate is configured on each RADIUS server. The CN is something generic, e.g. "wireless.mycompany.com"

In the second, the certificate is different on each server and the CN is the hostname of the server, e.g. "server1.mycompany.com"

My question is: Are both acceptable solutions? What are the pros and cons of each approach?

EDIT: Interested particularly in comments relating to ease of roaming for clients.

0

Although, both solutions will work, I would recommend to avoid certificate sharing across multiple hosts. It is related to private key management. As more entities have knowledge about the key, the lower security is provided. Because you can't certainly know which server compromised the key (as they share the same key).

The best practice dictates that no one than one entity shall know about any particular private key. Think about PIN from your credit card. Would you share it with someone?

Therefore, the best practice is to provide an individual certificate to each RADIUS server. You can assign unique name in each certificate (RADIUS server's host name, for example), or use generic common name in all RADIUS certificates. There is no best practice for RADIUS certificate naming.

  • This is a good answer with respect to general key management principles. Are there any reasons why this might not apply with respect to a RADIUS implementation? Some have cited ease of roaming as a reason for choosing a single certificate - I am interested to explore that point. – alifen Sep 7 '15 at 20:18
  • When roaming between APs and new RADIUS server is selected, a new authentication process is started. As the result, there is no difference when you use the same or different certificate. It is completely new RADIUS authentication session. – Crypt32 Sep 8 '15 at 5:20
  • Good info. Might there be instances where the client will roam more smoothly because it's seen the same certificate before and so can skip revocation checks? I realise now I may have been better writing this question from a WLAN infrastructure standpoint as I am more concerned with trends in vendor implementation for this scenario than the theory. Sorry! – alifen Sep 9 '15 at 8:08
  • "client will roam more smoothly because it's seen the same certificate before and so can skip revocation checks?". No, there will be no difference as long as all RADIUS certificates are issued from the same issuer. In short, if someone claims that certificate sharing improves UX, they are incorrect. – Crypt32 Sep 9 '15 at 18:22
  • Great - that was the sort of assertion for which I was looking! Can you provide a source? All I can find is anecdotal bits here and there, hence my posting this question. – alifen Sep 11 '15 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.