The clients are employees of a fairly loose network of companies, each on their own AD, some doesn't even have ad.
A frustrating mixture of Windows and OSX.
We maintain a central AD with all the user accounts in it but there are no machines associated with that AD.
The self signed certificate works but people get prompted to accept it and we were asked if it was possible for that to not happen.
The most likely users of this service would be the VIP types, it is expected to "just work" so here I am.
Self signed or commercial makes no difference as the certificate is only used for server authentication.
The only difference is users having to manually trust a cert or not.
Unless I am wrong.
On 25 January 2013 14:23,
<A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
> The reason I was attempting this is because I have to provide a service
> for roaming users and I was having issues with obtaining a certificate for
> the NPS server.
whats wrong with just using your current FR certificate on the NPS box?
> Does this mean that I could use a self signed certificate for the NPS that
> is recognized by the freeradius and have a commercial certificate on the
> freeradius that is then recognized by the clients?
what are your clients/userbase? why do you have to use a commercial certificate
for your server? if the clients authenticating are your clients then they can have
the required private CA installed - the authentication is a closed loop. if you use
a commercial cert eg thawte, verisign etc and only use that as trust then anyone can
get a cert signed by that commercial CA as a first point to subverting your security
alan
--
Bertalan Voros
m: 07932858025