Regarding Eap-tls process

[jain.manish94]

Hello Team,

Currently i m using Eap peap with server certificate only ok.

Now want to use Eap TLS and have 2000 users in my network thet all are domain joined.

Here i want to understand how eap TLS is increasing our cost and more hardware not getting this point.

Can any one plz help here with any good documents where it is mentioned that if we r going to use Eap TLS it will increase cost and hardware.

[JPavonM]

@jain.manish94 the only increase in the administrative cost (no need for additional budget) is for the certficates you need to deploy for every user/machine, no additional server if you already have the CA server.

[jain.manish94]

administrative cost  --- i did not get this point can you please make me clear it. 

actually i want to move from EAP-PEAP to EAP-TLS. 

what are required here. 

and how administrative cost is coming into the picture if i have 100 users with domain joined. 

[JPavonM]

What I mean with administrative cost is that you would bneed to generate all certificates in the CA and distribute them to users/machines.

Here and here you have a comparison on how to configuire EPAP and EAP-TLS on MS NPS.

HTH
-Jesus
*** Please rate helpful responses ***

[jain.manish94]

still not clear. 

because i have CA server as well then what are the challenges there to implement EAP-TLS. 

What I mean with administrative cost is that you would need to generate all certificates in the CA --- what are the challenges here and why we can not generate 2000 client certificates for the users. ?

[Flavio Miranda]

Hi

 Certificate cost and it is expensive, very expensive depending on the size of the network. Of course, if you were to deploy the proper way, I mean, with a Certifier signing your certificates.

It is not easy to share with you the prices because this information is not shared on the Internet. Usually the prices are send to companies directly because envolves neogociation and particularities that each company may have.

 I always handled EAP TLS but from the technical perspecitve, I never had to buy it, but I know it cost. You can deploy your own certifier and generate CSR files but then, you need to sign this files with Government authorized companies like TrustSign for example.

Amazon share this information and you can get some idea about costs.

https://aws.amazon.com/certificate-manager/pricing/?nc1=h_ls 

[jain.manish94]

Certificate cost and it is expensive, very expensive depending on the size of the network  ---- you mean to say when I will generate client certificate uses my own CA i have to pay cost for that client certificate ?

or how cost is involving here. please if you can share your practical knowledge if you have EAP-TLS setup. 

I have one CA server and 200 users where they are using client laptop with domain join and now i want 200 client certificate from my CA server how cost is involving here please tell me. 

[Flavio Miranda]

" you mean to say when I will generate client certificate uses my own CA i have to pay cost for that client certificate ?"

No, the cert itself is just a file. You can create them and distribute with almost no cost.  But, each certificate must be sign for a third party certifier and that´s cost. 

"I have one CA server and 200 users where they are using client laptop with domain join and now i want 200 client certificate from my CA server how cost is involving here please tell me. "

 But, do you have a full certificate chain properly signed by a Third party certifier ?

You may want to see this link.

https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/certificate-requirements-eap-tls-peap 

[jain.manish94]

But, each certificate must be sign for a third party certifier and that´s cost.  --- why each certificate must be sign for a third party , if i don this then what is the issue. ?

why CA is there if we need third part for client certificate only ?

what is PKI for client certificate and why we use this. ?

[Flavio Miranda]

This is related to how certificate system is built. It involves public and private keys, etc.  But, it also can be done different. If  the level of securiity you need can be attended with only a private CA, you can  handle it by itself and then the cost will be the minimum. Basically, work force for distribute and install. 

[jain.manish94]

If  the level of security you need can be attended with only a private CA, you can  handle it by itself and then the cost will be the minimum.   ----- Now why cost is here because this is my CA which is already there. 

one more question

This is related to how certificate system is built. It involves public and private keys --- when we get client certificate from CA how it is getting Public and Private both because this is my internal CA right. 

[Arshad Safrulla]

Assuming that you already have a Radius server

Cost -

1. If you don't have an existing CA, then you need to get a new CA. There are multiple vendors who provide private CA and you may have to do feasibility study and understand which vendor is suited for your environment and how it is going to cost you financially. Most orgs opt for Microsoft CA as this is free of cost if you have existing MS AD services.
2. Also another cost is configuring and managing the certificate authority and deploying certificates to clients,
3. if you have only domain joined PC's then MS GPO can push the certificates. But if not you have to consider the cost of manually installing the certificate or the cost for MDM to manage the non-domain devices.
4. Cost for reconfiguring the Radius server and it's support

Hardware-

1. Depends on what vendor you choose as CA, if you choose Microsoft depending on your requirement you might need few VM's running MS Server OS working as dedicated CA. So you need to consider the cost for software licenses of vm and os, if not vm then hardware cost along with other cost such as electricity etc.

EAP-TLS is somewhat complex compared to PEAP, from security pov we consider PEAP to be obsolete and as of now only EAP-TLS or EAP-TEAP (latest EAP mechanism, but client support is limited) to be secure. So whatever the cost will be if your org is security conscious then go with EAP-TLS. You can slowly migrate to EAP-TLS by creating a test SSID with EAP-TLS auth, test all the possible use cases and once ready for production rename the SSID and disable the PEAP SSID.