FAC - Wifi EAP-TLS authetication using only Machine certs

Forum|Forum|2 years ago
August 1, 2024
4 replies
1729 views

I'm trying to test authentication by using Machine certs instead of User certs. When I configure the windows supplicant to use "User or Computer" OR "User" I can authenticate. If I force the setting to "Computer" it fails. Both the computer and user certs are valid and signed by same CA.

I must be missing something in the Radius server config. Any ideas ?

Best answer by ebilcari

Without the binding, it should work as long as the certificate presented by the supplicant is valid. You can have more information by checking the RADIUS> Authentication debug logs: https://<fac>/debug/

xshkurti

Staff

FAC should be root ca for certificate issuing.

Wireless 802.1x EAP-TLS with computer authentication | FortiAuthenticator 5.5.0 | Fortinet Document Library

ebilcari

Staff

What version of FAC is running in this setup? Previous versions, would require certificate bindings with a valid username (hostname). Later version allows also certificate checks only to a Trusted CA:

More information can be found here, Identity source section.

Emirjon

doncacciatoconsutingAuthor

Explorer II

Yes, I have noticed in 6.6 you can use a local or trusted CA instead of bindings. Even when I select the "Trusted CA" option, if the supplicant only sends a Computer cert signed by that particular CA it fails. When the "User or Computer" OR "User", it works. I guess it's not a huge deal because both certs will be present, so why not send both. At this point I'm just curious why.

ebilcariAnswer

Staff

Without the binding, it should work as long as the certificate presented by the supplicant is valid. You can have more information by checking the RADIUS> Authentication debug logs: https://<fac>/debug/

Emirjon

Sign up

Login with SSO

Login to the community

Login with SSO