WiFi using FortiAuthenticator RADIUS with certificates

[TheOnlyJames]

Following this link - https://docs.fortinet.com/document/fortiauthenticator/6.0.0/cookbook/812128/creating-a-local-ca-on-f...

I am a little confused, the cookbook suggests you have to create a user certificate? i have over 500 LDAP users, that cant be right can it? it also suggests you create the local users on the FAC? thats a bit pointless, my FAC is connected to AD, so why would I need to create the users again,  Im looking for a solution where the users connected to the business WIFI, using their machine certs, not sure why we need user certs, is it another check or something? thanks

[ebilcari]

This a new option added in later versions of FAC, I guess you are still on the 6.4 firmware. Try to upgrade to the 6.5 firmware branch, the screenshot is from a FAC running 6.5.5.

[TheOnlyJames]

I am on 6.6.0, i created a new Policy and then was able to select cert, so this option, purely looks at the cert and lets the user authenicate, nothing else, whereas the other option does what? its the same thing?

[ebilcari]

Like shown also from within the FAC GUI, the bindings has an extra verification step. It will try to match the CN of the certificate to the username of a local/remote user. If that doesn't match the authentication will fail:

[The_Nude_Deer]

right! so this is the method I need to use. USER CERT, then checked in LDAP.. so its the 2nd option I need. right? thank you, there just isnt a clear guide for that option! still looking