What is RADIUS server certificate?
A RADIUS server certificate is used to prove that the RADIUS server a client is authenticating to is in fact the correct server. Based on the CN on the certificate, the end user can feel secure knowing that they will not fall victim to a Man-In-The-Middle attack.
How do I get a RADIUS server certificate?
Open Microsoft Management Console (MMC) on the server that will be hosting the RADIUS server. Select File > Add/Remove Snap-in. In the Available snap-ins list, click Certificates, and the click Add. In the Certificates snap-in window, select Computer Account, select Local Computer, and then click Finish.
When do you need a certificate for a server?
For example, a certificate that’s used for the authentication of a client to a server must be configured with the Client Authentication purpose. Or, a certificate that’s used for the authentication of a server must be configured with the Server Authentication purpose.
How to configure clients to validate server certificates?
You can configure clients to validate server certificates by using the Validate server certificate option. This option is on the Authentication tab in the Network Connection properties.
What do you need to know about certificate requirements?
The certificate must be configured with one or more purposes in Extended Key Usage (EKU) extensions that match the certificate use. For example, a certificate that’s used for the authentication of a client to a server must be configured with the Client Authentication purpose.
Do you need a root CA for EAP-TLS?
The user or the computer certificate on the client chains to a trusted root CA. The user or the computer certificate on the client includes the Client Authentication purpose. The user or the computer certificate doesn’t fail any one of the checks that are performed by the CryptoAPI certificate store.