Certificates are another way to provide the identity of a machine or user instead of a "password". The world of certificates and network authentication (dot1x) can be overwhelming, so I will try to explain the important concepts in this reply.
There are two common authentication methods being used in today's wireless deployments:
1. PEAPv0 which is based on username and password
2. EAP-TLS which is based on a machine or user certificate but requires a PKI
The process of getting the client connected and authenticated are similar for both methods:
1. Client associates to the wireless network;
2. Client builds a protected tunnel with the authentication server. Based on the certificate used on the (RADIUS) server side the client verifies that it is talking to the correct server so it knows that it is safe to continue;
3. Client sends its credentials to the server (username/password with PEAPv0, certificate with EAP-TLS);
3a. In case of EAP-TLS the certificate will be validated and read by the server. Usually the CN or SAN attribute found in the certificate will be used for the Active Directory lookup;
4. Server validates the provided credentials by consulting Active Directory;
5. Active Directory gives feedback and provided current status and all the memberships the related object has within Active Directory. This object can be a user account or computer in case of a machine certificate.
6. Based on the policies within the authentication server certain information can be provided to the WLC (Examples are: deny, allow and a specified VLAN which should be used etc).
If you want to deploy EAP-TLS the following things should be in place:
1. A PKI, preferable Microsoft's implementation which integrates within Active Directory;
2. A authentication server for example Cisco ISE or Microsoft's NPS which uses a server certificate which can be actually verified by the clients (so signed by public CA or own PKI if all of the clients do have to CA cert of the PKI installed);
3. Active Directory infrastructure with two GPOs deployed:
3a. GPO to auto enroll certificates so clients will request a user/machine certificate;
3b. GPO to configure the client with wireless settings;
4. A RADIUS based connection between the WLC and the authentication server;
5. Policies on the authentication server based on certain Active Directory groups so clients can be authenticated.
Hopefully this helps to give some clarity, however if you have never have done any implementation I strongly advice to get some external help. Building a robust and secure PKI requires proper planning and a good design, so goes for the authentication services.
Please rate useful posts... :-)
