We are trying to implement certs for clients to use when connecting to the Enterprise Wireless Infrastructure with the WLC.  We use a MS Domain and use ACS.  What is the best way to implement this to a gain security posture and avoid evil twin issues...