topic EAP-TLS with machine certificate in Wireless

EAP-TLS with machine certificate

ALFONSO MONEO VILORIA — Sun, 04 Jul 2021 07:41:56 GMT

Hello all,

I'm looking for a solution to authenticate both machine and wireless users. I've been finding out solutions like EAP-TLS using the machine certificate to stablished the tunnel and authenticating user credentials (LDAP store) over this tunnel. Now i want to know if is possible to use this configuration using an ACS Radius servers and what SOs are supported to do this without external supplicants (Windows XP, Windows 7, Windows 8, iOs, Android...).

Thanks a lot.

Best regards.

EAP-TLS with machine certificate

Anas Naqvi — Tue, 03 Sep 2013 16:09:58 GMT

Hi Alfonso,

Certificate Retrieval for EAP-TLS Authentication

ACS 5.4 supports certificate retrieval for user or machine authentication that uses EAP-TLS protocol. The user or machine record on AD includes a certificate attribute of binary data type. This can contain one or more certificates. ACS refers to this attribute as userCertificate and does not allow you to configure any other name for this attribute.

ACS retrieves this certificate for verifying the identity of the user or machine. The certificate authentication profile determines the field (SAN, CN, SSN, SAN-Email, SAN-DNS, or SAN-other name) to be used for retrieving the certificates.

After ACS retrieves the certificate, it performs a binary comparison of this certificate with the client certificate. When multiple certificates are received, ACS compares the certificates to check if one of them match. When a match is found, ACS grants the user or machine access to the network.

Configuring CA Certificates

When a client uses the EAP-TLS protocol to authenticate itself against the ACS server, it sends a client certificate that identifies itself to the server. To verify the identity and correctness of the client certificate, the server must have a preinstalled certificate from the Certificate Authority (CA) that has digitally signed the client certificate.

If ACS does not trust the client's CA certificate, then you must install in ACS the entire chain of successively signed CA certificates, all the way to the top-level CA certificate that ACS trusts. CA certificates are also known as trust certificates.

You use the CA options to install digital certificates to support EAP-TLS authentication. ACS uses the X.509 v3 digital certificate standard. ACS also supports manual certificate acquisition and provides the means for managing a certificate trust list (CTL) and certificate revocation lists (CRLs).

Digital certificates do not require the sharing of secrets or stored database credentials. They can be scaled and trusted over large deployments. If managed properly, they can serve as a method of authentication that is stronger and more secure than shared secret systems.

Mutual trust requires that ACS have an installed certificate that can be verified by end-user clients. This server certificate may be issued from a CA or, if you choose, may be a self-signed certificate

Also check the below link,

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/users_id_stores.html#wp1170404

EAP-TLS with machine certificate

ALFONSO MONEO VILORIA — Mon, 30 Sep 2013 11:17:03 GMT

Hello Anas,

thanks a lot for your response. I've finally discarded the idea of implement 2 authentications because I think that EAP-CHAINING (with ISE) is the only way to do really this.

Now, I'm going to implement only one authentication process based on machine certificate for Windows, Android and iOS using EAP-TLS.

Your help will be very useful to do this!.

Best regards,

Alfonso Moneo

Re: EAP-TLS with machine certificate

Derrick Robba — Sat, 05 Oct 2013 18:32:11 GMT

Will a machine cert work in 5.3?

Sent from Cisco Technical Support iPad App

Re: EAP-TLS with machine certificate

Scott Fella — Sun, 06 Oct 2013 03:24:26 GMT

If you are talking about ACS 5.3, yes it supports EAP-TLS which does requires a machine certificate. It's supported in most of the v4.x and v5.c of ACS.

Sent from Cisco Technical Support iPhone App

Re: EAP-TLS with machine certificate

Jatin Katyal — Sun, 06 Oct 2013 03:34:37 GMT

Yes With EAP-TLS we should have machine cert installed on the end-client and ACS 5.3 does support.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.3/user/guide/users_id_stores.html#wp1170404

~BR
Jatin Katyal

**Do rate helpful posts**

EAP-TLS with machine certificate

Derrick Robba — Sun, 06 Oct 2013 04:59:38 GMT

Thank you all!