Phil Mayers wrote:
Yes. However, buying separate certs might not be a good idea as it will complicate the client setup - they'll all have to come from the same CA and share the same CN (or you'll have to rely on wildcard CN matching on the clients).
Has that actually been tested to work across the gallery of clients? It is my impression that a lot of clients (e.g. IOS) will just barf on any certificate that isn't the first one it encountered on an SSID, unless and until the user gets frustrated and reconfigures. Not that I think running multiple certs offers any real benefit. Perhaps for transitional purposes when expiry dates come up. (Note: this behavior, while not completely secure, is probably as secure as one could expect on a ...ehem... "BYOD" network with a nonconforming user base, and is certainly superior to Android which will trust anything you hand it.) (Oh, also, if anyone wants to play with clients in a test environment by sending them strange certificates at inopportune times, I left some code on github at skids/freeradius-server/tree/clientverify. It is too ugly to propose as a serious patch, though.)