WLC 4400: EAP-TLS

[Jaaazman777]

Good day!

I tried to set up the EAP-TLS according to

- http://cciew.wordpress.com/2010/06/10/eap-tls-on-the-wlc/

- http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a77592.shtml

- Jeremy video about EAP-TLS

The main question is about certificates.

Tell me if I am wrong -  There are two types of certificates that we need to upload to the WLC:

1) Device certificate - this is quite clear, OpenSSL, Certificate Request and e.t.c.

2) CA Root certificate - if there is only one CA Root than clear, but if we have the following chain

Root CA -> Intermediate CA -> WLC

a) Do we need to upload the whole chain "Root CA -> Intermediate CA" to the WLC ?

b) If yes, what format is it going to be? maybe smth like this

------BEGIN CERTIFICATE------
*Intermediate CA cert *
------END CERTIFICATE--------
------BEGIN CERTIFICATE------
*Root CA cert *
------END CERTIFICATE------

[Jaaazman777]

Hello!

I'd like to return to the question about root certificates.

For example:

- we have one ROOT CA and two intermediate CA:  ca1, ca2

- we have two groups of users with certificates signed by these intermediate CAs.

Purpose - we want users from both groups to pass the authentication process.

As we can't upload two root CA to the wlc, can we upload only ROOT CA for that purpose?

[Scott Fella]

If your doing EAP-TLS, you will have a certificate installed in your Radius server and your clients would also have a certificate obtained from one if the two intermediate CA. You still have one root ca. So with any of your intermediate ca's, the root ca is the same.

You client devices will trust the root ca (if setup right) so you can validate the server certificate.

Sent from my iPhone

[Jaaazman777]

in software version 7.0.220.0 there is the OSCP feature

http://www.cisco.com/en/US/customer/docs/wireless/controller/release/notes/crn7_0_220_0.html#wp784178

It can get the revocation status of the management user's certificate, while user accesses the GUI by https

Can we use OSCP during the wireless client auth process to check the users certificate validity?

[Scott Fella]

Not for 802.1x. You would need to configure the CRL on the radius sever.

Sent from my iPhone