<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
<BR>> Hi,<BR>> > Hello everyone.<BR>> > Im trying to understand how the certificates work in Freeradius.<BR>> > Last time I asked about why I need to install a root certificate on all the windows clients I got the answer that it is because PEAP works that way. But when I read about it on other sites it says that EAP-TTLS and PEAP was created so that you wont need client-side certificates?<BR>> <BR>> client-side certificate means a specific cert for the client..not the root CA.<BR>> <BR>> you need a root CA installed because thats that the RADIUS server has been signed with.<BR>> if you've used a CA to sign the RADIUS cert that is commonly in the client you wont need<BR>> to install the CA...but eg self-signed CA will need to be installed.<BR>> <BR>> > The PEAP0 I want to use is EAP-MSCHAPv2 since that one should not require client-side certificates if I have understood it correctly.<BR>> <BR>> RADIUS server signed by CA<BR>> CA needs to be on the client if you want to really trust/verify the cert<BR>> <BR>> alan<BR><BR>
Okay, so is there anyway for me to get the root CA installed without having to do it manually on the clients?<BR>
<BR>
Peter<BR> <br /><hr />Windows Live: Make it easier for your friends to see <a href='http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_2:092009' target='_new'>what you’re up to on Facebook.</a></body>
</html>