MP

Certificate-based enterprise Wi-Fi

Wireless access tied to managed devices through an internal PKI, RADIUS, and Group Policy. No shared password.

Certificate-based Wi-Fi authentication flow The internal certificate authority issues certificates to managed, domain-joined devices through Group Policy autoenrollment. A device presents its certificate to the access point over 802.1X. The access point sends the request to the RADIUS server, which checks the certificate against the internal CA before access is granted. Internal CA AD CS / PKI Group Policy autoenrollment Managed device domain-joined RADIUS NPS checks cert against CA 802.1X authenticate Access point WPA2/3-Enterprise
Devices receive certificates automatically, then present them over 802.1X. RADIUS checks each one against the internal CA before the device gets on the network.

Problem

A shared Wi-Fi password can't tell a managed device from anything else that knows it, and it can't be taken back from one device without changing it for everyone. The goal was wireless access tied to device identity, not to a secret that travels.

Approach

  • Identity from PKI. An internal certificate authority issues the certificates that identify the organization's devices.
  • Zero-touch enrollment. Group Policy autoenrollment has domain devices request and renew their own certificates, with nothing for the user to install or type.
  • Verify every connection. RADIUS validates each device's certificate before the network lets it on.
  • Enterprise mode. The wireless network runs WPA2/WPA3-Enterprise, with 802.1X handling authentication at the access point.

Stack

  • AD CS / internal PKI
  • Group Policy
  • NPS / RADIUS
  • 802.1X
  • WPA2-Enterprise
  • WPA3-Enterprise

Outcome

Managed devices connect automatically with a certificate the user never sees. There's no Wi-Fi password to hand out or leak, and access belongs to the device, so it can be pulled for one machine without touching anyone else.