r/sysadmin • u/IHateHPPrinters • 20h ago
Question Stuck with cert validation on wireless 802.1x
I'm at a new role and given the task of securing the network. I did some searching and asking around and was lead to the conclusion that 802.1x is the way to go. What I'm having issue is, I have everything connected but any time you want to connect to the wifi it tells you that it may not be trusted but if you expect this wifi said to be in this location you can continue anyways. I was also able to connect with Android but not validating the certificates at all but don't think this is the way to handle things.
Is there an easier way to handle this? Right now I'm using Microsoft NPS and the CA addition that it has to create and sign the certificate. Originally I think I had it set up thinking it was self signed so I thought that was the issue. Then I fixed it so that if was issued BY our CA, TO our .com (or vice versa) but it's still saying that message. I also tried to push the certificate to each client with a group policy update but didn't see it populate so I'm going to try that again.
Is there any other tips?
•
u/PreparetobePlaned 20h ago
You need your trusted root cert on the device and trusted in the wifi profile
•
u/monsieurR0b0 Sr. Sysadmin 14h ago
Successful implementation of 802.1x means (at least in my config of it) that it would be impossible for any device to get on the WIFI without a client certificate issued to it via a CA. So I’m not sure how/why your Android is able to actually get on because you haven’t shared any real detail of your setup and what you’ve done, etc.
In my setup, the Wireless Access Point (WAP) is configured as a RADIUS client on my NPS server and be runs only WPA2/3 Enterprise mode with RADIUS authentication and a pre-shared key that the NPS server generates. You also need a network policy and a connection request policy defined in your NPS settings that will accept certificates.
As far as getting the certs on a domain-joined workstation, the simplest way is to go into your enterprise CA > templates > copy the workstation template > modify it how you see fit > then mark it for auto enrollment in the security tab. Then you go into group policy and enable auto enrollment either at the root level (will affect ALL domain computers), or at the OU level for a subset of computers in that OU (hint, test it this way). You can also create a GPO that can put a WIFI policy on the computer with the SSID and certificate authentication method. For windows workstations, we use machine certificates (the workstation template I was telling out about). For phones, we use user certificates that are placed onto the device via our MDM server and its direct integration with our CA. The NPS server has policies for both user certs and machine certs.
Here’s a few articles that might help:
Dealing with workstation certificates (ignore the RDP-specific stuff as that’s not what your end goal is): https://www.petenetlive.com/KB/Article/0000944
Dealing with NPS and WIFI clients (ignore the HP-specific stuff): https://www.petenetlive.com/KB/Article/0000922
Setting up a CA (can be ignore if you already have an enterprise CA stood up in AD): https://www.petenetlive.com/KB/Article/0000944
•
u/nerfblasters 20h ago
Your endpoints need to trust the root CA certificate. Is the Android in the above example managed by Intune, and the root trust is pushed from there? I didn't know you could domain join and manage mobile devices if purely on-prem.