FortiNAC-F and EAP-TLS

Forum|Forum|10 months ago
October 9, 2025
5 replies
893 views

We currently utilize the Local RADIUS server on FortiNAC-F to perform EAP-PEAP. It works well. However, I'd like to transition to EAP-TLS but can't really wrap my head around what needs to be done to make that happen.

We have a 3rd-party cert from Sectigo uploaded to FortiNAC-F for Local RADIUS Server (RadSec) and Local RADIUS Server (EAP) [radius]. What else is needed?

FortiNAC

Atul_S

Staff & Editor

Hi,

Have you tried configuring TLS under the supported EAP type already? Also, make sure the client cert attribute is configured correctly.

Thanks,

ebilcari

Staff

A PKI infrastructure must be in place to issue and manage certificates, which are then distributed to each endpoint. Typically, Microsoft Certificate Authority (CA) is used for this purpose. Some details are also shown in this configuration guide: https://docs.fortinet.com/document/fortinac-f/7.6.0/machine-authentication/730802/tls-certificate

Emirjon

AEK

SuperUser

As far as I remember the public certificate will not work with RADIUS. A private cert is required, right?

AEK

ebilcari

Staff

The RADIUS/EAP server certificate is usually signed by a private CA, but it can also be signed by a public one. However, client certificates (EAP-TLS) are rarely signed by public CAs because they are mainly used inside an organization and it's easier to manage them with your own internal CA.

Emirjon

Sign up

Login with SSO

Login to the community

Login with SSO