On 19 Feb 2015, at 14:26, HCC Lists <hcc.lists@gmail.com> wrote:

Hello

I am being thrown into a project head first and trying to get up to speed.

From what I have read I need to have a certificate for using WPA2 Enterprise.

Yes

I would prefer not having to go to each machine spread geographically around a fairly wide area to install a CA certificate. Is it possible to use a purchased certificate so that Windows 7 recognizes it and will connect?

Yes

I think I only need one certificate for the RADIUS server, but still unsure. Does it work with multiple SSID's from different AP's?

Yes

What about redundant RADIUS servers? Do I need a certificate for each?

No. The CN in the cert doesn't get verified against a URI like it does in something like https://. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

Hello,

From what I have read I need to have a certificate for using WPA2 Enterprise. I would prefer not having to go to each machine spread geographically around a fairly wide area to install a CA certificate. Is it possible to use a purchased certificate so that Windows 7 recognizes it and will connect?

You can use such a certificate, but you still need to manually mark it as trusted for WPA2 Enterprise purposes (none of the installed CAs qualify "autoamgically", trust is configured explicitly). There's more to configure client-side than just install a CA certificate or mark it as trusted. Things like anonymous outer identity are nice features, but involve ticking the right boxes on the machines. There are tools which do that for you. Windows group policies can do it for Windows clients. For BYOD scenarios, web services like https://802.1x-config.org cover a wider range of clients (free, with some paid-for optional upgrades: https://802.1x-config.org/tour4.php ). If your project is by any chance related to the eduroam roaming consortium, your instance of this web service would be https://cat.eduroam.org which has the richest feature set, entirely for free for eduroam participants. Greetings, Stefan Winter

I think I only need one certificate for the RADIUS server, but still unsure. Does it work with multiple SSID's from different AP's? What about redundant RADIUS servers? Do I need a certificate for each?

I have googled and not seen anything definitive for these questions. I will continue to search, but hopefully someone who has this sort of setup working can answer those questions and I can carry on with getting it setup.

Thanks Michael - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66