0

In other wirds, rather than installing an Enterprise Root CA and having internal PKI. Can I buy a $30 cert from Thawte for example and then use it on my IAS server? Is this not a better and cheaper solution? Thanks folks. Stretched Silly admin

3 Answers 3

1

We do this with our campus 802.1x wireless authentication using eap-ttls.

It also differs from supplicant to supplicant.

Some, such as the native OSX one, require you to select which root CA you use for verifying the radius server's cert. Your users would have to select the proper CA from a dropdown (or perhaps import one if you use a local CA). On the iphone, you have to create a profile using the iphone configuration utility.

I believe there are differences between, for example, the intel and dell wireless supplicants. For instance (looking at intel config right now) there is a check box for "trust any CA" or "specify server or certificate name."

You'll have to test your local situation. But -- the short answer is -- yes, you may use a well-known CA to sign your EAP cert.

0

Well, if you create your own CA and use it to sign a cert for radius/eap, that'll be free, which is a lot cheaper than spending $30.

That's the route I take (that is, I use my own CA) and it works fine. For Windows clients (esp. Vista/Win7), you'll want to copy your CA's public key to the Windows machine and import it, so that Windows will trust the radius/eap cert when connecting to wireless.

Of course, if you spend the money for a Thawte cert, it might be easier to deploy wireless clients as you (probably) don't have to do that CA key import. So it's a matter of how many clients you'll be setting up vs. the $30/year (or whatever it is) cost.

2
  • This only works well if you control the end stations as well. Otherwise you need to tell the users to trust your ca, and tell them how to import your CA into their supplicant's trusted list of certs. A typical 802.1x wireless distribution assumes that all the systems are windows and on a domain, which simplifies this because you shove the certs into the hosts via a policy. But, in other environments, this isn't a good assumption (that you can modify the end points).
    – chris
    Nov 30, 2009 at 19:08
  • Unless you have unlimited time on your hands (please tell me how!) then your time to setup and maintain a CA internally (properly!) is significantly more than $30 for a cert each year.
    – Ashley
    Mar 2, 2017 at 16:39
0

If you want to use a certificate from a public CA for client authentication, you must tell IAS/NPS/ISE/your RADIUS server (whatever you are using as Network Access Controller (NAC)) that this is a CA that you trust for client authentication. But since this is a public CA, anybody can pay the money and get a certificate from it and have a certificate that your NAC trusts.

You would have to add some additional filters to make sure that only your certificates are authorized to access your network, like filtering for the Subject in the certificate. Note also that you need to trust the Public CA, as it can issue certificates at any time that gives access to your network, which might be a risk depending on what kind of network you have.

Therefore, it can be technically possible in some cases to use certificates from a Public CA for RADIUS authentication, but most often it is not advisable.

When it comes to cost, as Heath's answer argues, and if you have a cloud-based environment, you might use SCEPman as cloud-based PKI, which offers a free Community Edition. Disclaimer: I am one of the SCEPman developers.

You must log in to answer this question.