topic Re: How to generate certificates for 802.1x authentication for the access points? Thanks. in Aerohive Migrated Content

How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Mon, 06 Aug 2018 20:26:28 GMT

How do i generate certificate requests for use in 802.1x authentication for the access points, as seen under Configuration -> Network Policy -> Additional Settings -> Secure Port Settings?

I tried to set them up with PEAP, but the radius server recieves messages where the username is set to INVALID for some reason.

So either I have to figure out what causes that, or try to use certificates, which is the way I really want to go.

Thanks.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

samantha_lynn — Mon, 06 Aug 2018 20:57:52 GMT

What client types are we plugging in to the switch port? The default certs should work fine. Also, what HiveManager platform are you using (HiveManager (formerly NG)(cloud.aerohive.com), or HiveManager Classic (myhive.aerohive.com))?

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Mon, 06 Aug 2018 21:06:09 GMT

It is AP250's, connected to a Cisco 2960x.

We use Hivemanager Classic, a standalone version that we host ourselves.

The default certificates will not work, unless we import them into our radius server of course.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

samantha_lynn — Mon, 06 Aug 2018 21:23:27 GMT

Thank you for clarifying. To generate a CSR you will want to go to Configuration> Expand the left hand side menu> Advanced Configuration> Keys and Certificates> Server CSR> Fill in the form and click "Create". You can import that into your DC so your DC can sign it.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Tue, 07 Aug 2018 13:15:26 GMT

I created a CSR, imported it to our CA server, and created a web server certificate.

But how do I sign it in Hivemanager?

And also; under Secure Port Settings, it asks for a Private Key File.

How do I get that? Do I just link to the same web server certificate?

Thanks.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Wed, 08 Aug 2018 21:17:37 GMT

Nothing?

Are there any examples at all out there that is outlining how to do this?

I can't be the only one.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

samantha_lynn — Wed, 08 Aug 2018 22:25:58 GMT

I'm sorry, I think there is some confusion on how these certs work. You would download the CSR from the HiveManager, import that in to your CA, your CA signs it, and should give you three things: The CA cert file (this is the intermediate and root certs concatenated together), the server cert file (this is the one the CA signs), and the key file. All you would need to do from there is import these in the the HiveManager, the HiveManager doesn't sign these again.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Thu, 16 Aug 2018 01:45:25 GMT

Thanks, I will start working on this now.

But our CA server (it's a Windows 2016 CA) has never given me a separate key file, so I have to figure out how to split the certificate it actually gives me.

And what certificate template should I use when signing the CSR?

Web server? Computer? User? There are a lot to choose from 🙂

Thanks.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Thu, 16 Aug 2018 01:46:22 GMT

Still puzzled why I can't get it to work with username / password / PEAP, though.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

bruce_stahlin — Thu, 16 Aug 2018 07:56:13 GMT

Since you mentioned Win2016, I'm assuming your using AD and perhaps NPS to authenticate. Are your APs acting as a RADIUS server or client? In other words, have you configured them to link to AD or are they just passing the supplicant request to NPS for authentication?

If they are the server, you'll need the cert. If they are a client, NPS should be handling the certs and the APs just need to be registered clients in NPS.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Thu, 16 Aug 2018 14:33:47 GMT

I'm not sure you understand.

It is the accesspoints I want authenticated against a 802.1x enabled switchport, not the clients connecting to the accesspoints.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

bruce_stahlin — Thu, 16 Aug 2018 19:42:19 GMT

I see, thank you for the clarification.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

samantha_lynn — Fri, 17 Aug 2018 00:35:34 GMT

I'm sorry for the delay getting back to you, we have been looking in to this for you and it looks like Web server would be your best option. Technically speaking, the SSL certs are pretty much the same with the exception of the type of attributes they contain. Radius SSL certs in particular have two authentication attributes that must be included.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

dal — Fri, 17 Aug 2018 13:42:06 GMT

Great, thanks.

Then I only need to figure out how to "extract" a private key file from the sertificate that the Windows CA generates, since it seems that Hivemanager requires a separate private key file.

Any tips on how to do that?

Thanks.

Re: How to generate certificates for 802.1x authentication for the access points? Thanks.

samantha_lynn — Mon, 20 Aug 2018 19:24:58 GMT

Can't say that I've tried with a Windows CA cert, but theoretically you should be able to export the certificate into PFX files to separate out the private key (assuming the CA template you are using allows the private key to be exported). Windows support would probably have better tips for you.