On Nov 19, 2024, at 6:55 AM, Alexey D. Filimonov <alexey@filimonic.net> wrote:
Addition: Set up AD Certification Services to issue certificates to domain-joined computer. Configure AD CS to publish CRLs to HTTP instead of LDAP. Create a certificate template with special EKUs: 1.3.6.1.5.5.7.3.14 (EAPoL) and 1.3.6.1.5.5.7.3.2 (Client auth). Use EAPoL EKU in WLAN Group policy to configure certificate selection for EAP-TLS. Configure automatic enroll of those certificates to "domain computers" group.
The scriptsand configuration files in raddb/certs will automatically add those EKUs.
Also it looks like easier to setup Microsoft NPS as RADIUS if most of your clients are Windows. As you need EAP-TLS for computers and PEAP-MSCHAPv2 for unmanaged devices. PEAP is quite difficult to setup and manage with FreeRADIUS, IMO.
Why? a) check that username / password authentication works as per docs in sites-enabled/inner-tunnel b) add certs to EAP c) PEAP works. The hardest part about it is reading the documentation. Alan DeKok.