0

What are the upsides and downsides of using EAP-TLS authentication with certificates for WiFi client connections? How is this superior than just using standard WPA2 password authentication?

How do I configure EAP-TLS authentication for an MikroTik router?

1

Using EAP-TLS certificates to authenticate WiFi clients:

Upsides:

  • Granular Access Control: Access can be both granted and restricted on a certificate basis, unlike WPA2 authentication where all users share the same password for the SSID
  • Identity Validation: WPA2 password auth only proves a connecting WiFi user knows a password. A Certificate validates the identity of both users and the AP they're connecting to

Downsides:

  • Higher Administrative Burden: Creating certificates for each WiFi user and configuring their access requires more effort than setting a shared password.
  • Unsuitable for Public Networks: Hotels, airports, cafes, etc cannot configure certificate based access for their large, transient WiFi user populations.

CONFIGURATION PROCESS OVERVIEW: MikroTik ROUTER

NOTE: Procedures documented where developed using RouterOS v6.45.1 and tested & known to work correctly as of 20190706. However, in making them generic it's possible I could have introduced an error; please advise if any found and I will update them accordingly.

A) CREATE CERTIFICATES: (3) types of certs must be created:

  • Server: Create a Certificate for MikroTik side of EAP-TLS connection

  • Client(s): Create a certificate for each Client connecting to MikroTik WiFi Access Point via EAP-TLS

  • Certificate Authority: This certificate used to create a Chain of Trust for certs by signing both Clients' & Server certs

B) CONFIGURE EAP-TLS: After creating client certs, these can now be used to config Wireless Security Profiles enabling EAP TLS as an authentication method

C) CONFIGURE VIRTUAL AP WITH EAP AUTH: Create a Virtual AP which enforces EAP TLS using the Security Profile just created.

SECTION 1: CREATE CERTIFICATES

Create CA (Certificate Authority) Certificate:

Replace "1.2.3.4" with PUBLIC IP of MikroTik router and replace other place-holder values with your own before executing below commands:

/certificate add name=CAF1Linux-template common-name=CAF1Linux country=GB days-valid=3650 key-size=4096 locality="Your Town" organization="Your Orgsanization" state=YourCounty trusted=yes unit="Technical Services" subject-alt-name="IP:1.2.3.4" key-usage=digital-signature,key-cert-sign,crl-sign;

/certificate sign CAF1Linux-template ca-crl-host="1.2.3.4" name=CAF1Linux

Export a PEM Format Cert:

/certificate export-certificate CAF1Linux export-passphrase="REPLACE ME WITH YOUR OWN CA PASSPHRASE"

Export a PKCS12 Format Cert:

/certificate export-certificate CAF1Linux export-passphrase="REPLACE ME WITH YOUR OWN CA PASSPHRASE" type=pkcs12

Create SERVER Certificate:

This is the certificate for the MikroTik.

Again, replace "1.2.3.4" with PUBLIC IP of MikroTik router and of course replace all the other place-holder values with your own before executing below commands:

/certificate add name=F1LinuxVPNserver-template common-name="1.2.3.4" country=GB days-valid=3650 key-size=4096 locality="Your Town" organization="Your Organization" state=YourCounty trusted=yes unit="Technical Services" subject-alt-name="IP:1.2.3.4" key-usage=digital-signature,data-encipherment,key-agreement,ipsec-tunnel,ipsec-end-system,tls-server,tls-client;

/certificate sign F1LinuxVPNserver-template ca=CAF1Linux name=F1LinuxVPNserver

/certificate set F1LinuxVPNserver trusted=yes

Export a PEM Format Cert:

/certificate export-certificate F1LinuxVPNserver export-passphrase="REPLACE ME WITH YOUR OWN ROUTER PASSPHRASE"

Export a PKCS12 Format Cert:

/certificate export-certificate F1LinuxVPNserver export-passphrase="REPLACE ME WITH YOUR OWN ROUTER PASSPHRASE" type=pkcs12

Create CLIENT Certificates:

An example for a MacBook shown below. However, the process is the same for any device- an iPhone, iPad, anything that supports EAP-TLS auth- just remember to change default values including the passphrase when the commands to create certificates for other client devices.

/certificate add name=F1LinuxClientMacbook-template common-name=F1LinuxClientMacbook country=GB days-valid=3650 key-size=4096 locality="Your Town" organization="Your Organization" state=YourCounty trusted=yes unit="Technical Services" subject-alt-name="" key-usage=digital-signature,data-encipherment,key-agreement,ipsec-tunnel,ipsec-end-system,tls-client;

/certificate sign F1LinuxClientMacbook-template ca=CAF1Linux name=F1LinuxClientMacBook

/certificate set F1LinuxClientMacBook trusted=yes

Export a PEM Format Cert:

/certificate export-certificate F1LinuxClientMacBook export-passphrase="REPLACE ME WITH A DIFFERENT PASSPHRASE FOR EACH CLIENT CERTIFICATE"

Export a PKCS12 Format Cert:

/certificate export-certificate F1LinuxClientMacBook export-passphrase="REPLACE ME WITH A DIFFERENT PASSPHRASE FOR EACH CLIENT CERTIFICATE" type=pkcs12

SECTION 2: CONFIGURE WIRELESS SECURITY PROFILES

After creating Client certificates for each device requiring WiFi access, you can now create Wireless Security Profile for them. Unlike standard WPA2 password encryption, authentication is nailed-down to a certificate on a device, thus, each connecting client will require its' own Wireless Security Profile.

/interface wireless security-profiles name="EAP_TLS_Macbook2018" mode=dynamic-keys authentication-types=wpa2-eap unicast-ciphers=aes-ccm group-ciphers=aes-ccm wpa-pre-shared-key="" wpa2-pre-shared-key="" supplicant-identity="" eap-methods=eap-tls tls-mode=verify-certificate tls-certificate=F1LinuxClientMacBook.p12_0 mschapv2-username="" mschapv2-password="" disable-pmkid=no static-algo-0=none static-key-0="" static-algo-1=none static-key-1="" static-algo-2=none static-key-2="" static-algo-3=none static-key-3="" static-transmit-key=key-0 static-sta-private-algo=none static-sta-private-key="" radius-mac-authentication=yes radius-mac-accounting=yes radius-eap-accounting=yes interim-update=0s radius-mac-format=XX:XX:XX:XX:XX:XX radius-mac-mode=as-username radius-called-format=mac:ssid radius-mac-caching=disabled group-key-update=5m management-protection=allowed management-protection-key=""

SECTION 3: CONFIGURE VIRTUAL AP WITH EAP AUTH

Finally we'll setup an Virtual AP that uses the EAP TLS Security Profile: Again, go through the below code and replace my place holders- including the MAC with all "X"s- with your own details:

interface wireless name="wlan_EAP" mtu=1500 l2mtu=1600 mac-address=XX:XX:XX:XX:XX:XX arp=proxy-arp interface-type=virtual master-interface=wlan5ghz mode=ap-bridge ssid="wlan_EAP" vlan-mode=no-tag vlan-id=1 wds-mode=disabled wds-default-bridge=none wds-ignore-ssid=no bridge-mode=enabled default-authentication=no default-forwarding=yes default-ap-tx-limit=0 default-client-tx-limit=0 hide-ssid=yes security-profile=EAP_TLS_Macbook2018

To learn how to configure IOS Clients to the MikroTik using EAP-TLS certificates, go HERE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.