ACTIVE DIRECTORY / PKI / EAP-TLS
Network Access with Certificates
I wanted devices to identify themselves with certificates instead of sharing a Wi-Fi password. That meant making Active Directory, the certificate authority and FreeRADIUS work together for different client systems.
The setup
Directory services
Two Windows Server 2025 domain controllers provide replicated Active Directory and DNS services, including LDAPS for directory lookups.
Certificates and RADIUS
An enterprise CA issues device certificates. FreeRADIUS checks the certificate and applies the network access policy.
What worked in testing
- Wired and Wi-Fi EAP-TLS: supported clients authenticated using managed certificates.
- LDAPS failover: I made the primary directory controller unavailable and checked that lookups continued through the second one.
- Windows: auto-enrollment and wired authentication profiles were deployed and tested.
- Linux: directory integration and certificate-based wired or wireless connections worked in the tested setup.
- Android: managed devices received SCEP identities that they could use for enterprise Wi-Fi.
- Revocation: I tested CRL updates and the resulting authentication behavior.
One important distinction
Two domain controllers help with directory availability, but they do not make the certification authority and SCEP enrollment service redundant. Those components still need their own recovery plan.
More on AD CS, NDES and FreeRADIUS → Linux and Android enrollment →