topic Re: RADIUS WITH NPS windows 2012 in Aerohive Migrated Content

RADIUS WITH NPS windows 2012

agroch — Thu, 11 Jul 2019 07:38:54 GMT

I have Windows 2012 NPS with CA - AD CS- I am trying to setup PKI from scratch: CA ROOT then Enterprise Subordinates with CA, web etc. I have noticed when I remove CA from NPS radius stopped working. Is there any pace pointing to CA server?

Re: RADIUS WITH NPS windows 2012

samantha_lynn — Thu, 11 Jul 2019 20:26:54 GMT

I'm sorry, I'm not sure what you mean by "Is there any pace pointing to CA server", but our Radius set up would need to know what certificates to use, and if a change is made on the NPS side of things that isn't also reflected in the Radius setup within the HiveManager, then you would see Radius connections failing.

Re: RADIUS WITH NPS windows 2012

agroch — Thu, 11 Jul 2019 21:10:31 GMT

Sorry for my question. let's imagine I am starting with 802.1X and want to create certificate for it - do you have any documentation how to build such certificate? I am using Windows PKI infrastructure. How that certificate should look like?

Re: RADIUS WITH NPS windows 2012

samantha_lynn — Thu, 11 Jul 2019 21:18:48 GMT

You can create a self signed certificate within HiveManager (if you're interested in this and you can tell me which HiveManager platform you are using (see guide below to determine this), I can give more details on how to do this), or you can purchase a third party certificate from a certificate authority(CA) such as GoDaddy.

Using a self signed certificate is not as secure as a third party certificate from a CA, and self signed certificates will still present a warning to end users that the site is not verified as safe.

If you're using a third party certificate, you'll want to make sure the CA gives you the Cert file (the file that has the domain name), the Server Cert file, and the Key file. If these are given as separate files, you'd want to concatenate them in to one file to import it in to HiveManager.

This guide will walk you through how to determine which HiveManager you are using, for reference: https://thehivecommunity.aerohive.com/s/article/Which-HiveManager-Platform-am-I-using

Re: RADIUS WITH NPS windows 2012

agroch — Thu, 11 Jul 2019 22:28:38 GMT

I use cloud.aerohive.com - and we are currently building PKI CA infrastructure so definitely I want to use that. Using godaddy cert is always an option but I try to stay away from that.

Re: RADIUS WITH NPS windows 2012

agroch — Mon, 15 Jul 2019 20:58:18 GMT

To be honest this is driving me crazy with that "Insecure Certificate" on non domain devices. It looks like I may use goDaddy or build in Aerohive generated certificate. Can you please share the guide for them? My understanding is once the cert is uploaded to the NPS - we completely forget about the "Unsecure Certificate" message - correct?

Re: RADIUS WITH NPS windows 2012

samantha_lynn — Mon, 15 Jul 2019 21:03:57 GMT

Using a self signed certificate built in the HiveManager will still give you that untrusted site error, so you'd want to go with a third party certificate, like from GoDaddy or a different certificate authority. Once this cert is loaded on to the Radius server, that untrusted site message will go away. To create a CA to send to your third party certificate authority you'll want to go to Configure> Common Objects> Certificate Management (left hand side menu under Certificate header)> HiveManager CA. You'd submit this CA to GoDaddy or whichever company you choose so they can generate the certificate you'll need.

Re: RADIUS WITH NPS windows 2012

agroch — Mon, 15 Jul 2019 21:38:28 GMT

What about if we currently have SSL certificate from GoDaddy? Currently using on some other servers. Should I still submit it to GoDaddy as you described or I can use somehow existing Godaddy Certificate?

Re: RADIUS WITH NPS windows 2012

samantha_lynn — Mon, 15 Jul 2019 23:30:51 GMT

As long as the domain would be the same for the server and Radius server then you might be able to use the same cert, it couldn't hurt to try. I can't say for certain because there are some options when you create the cert that could limit it's functionality but depending on how it was set up, we could certainly use it for Radius as well.