Implement WPA2 Enterprise Encryption on Your WLAN - Page 2

By  Eric Geier | Dec 9, 2010
Page 2 of 2   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

Creating and maintaining a PKI for digital certificates

If you're setting up your RADIUS server, another concern you might have is creating and maintaining a Public Key Infrastructure (PKI ) and certificate authority (CA) for issuing the digital certificates required by the 802.1X authentication. However keep in mind, if you use the PEAP protocol for 802.1X only one digital certificate is required for the RADIUS server, rather than the server and all the clients with the EAP-TLS protocol.

Remember, if you use a hosted RADIUS/802.1X service, you don't have to worry about this at all.

To get the digital certificate for the RADIUS server you can create your own CA, which most RADIUS servers help you with. Then a client configuration wizard like the three I mentioned can help install the CA certificate to the computers and devices.

If you don't want to install the CA certificate on all the computers, you can pay to get a digital certificate signed by a public CA, like VeriSign or GoDaddy. Most RADIUS servers can also help you create a signing request to submit to the public CA in order to get the signed certificate for the RADIUS server. GoDaddy charges as little as $50 for a SSL certificate.

Man-in-the-middle attacks

WPA2 Enterprise is also vulnerable to some attacks. For example, someone could setup an AP with the same SSID and a modified RADIUS server in hopes of capturing and cracking the login credentials. However, you can help prevent this type of attack from being successful by ensuring you specify three optional settings in Windows, on the PEAP or Smart Card/Certificate window:

  • Check the Validate server certificate option and select the Trusted Root Certificate Authority from the list.
  • Check the Connect to these servers option and input the domain name or IP address of the RADIUS server.
  • Check Do not prompt user to authorize new servers or trusted certificate authorities.

Similar settings exist for most other operating systems and devices.

Also remember that you can apply these settings with a client configuration wizard like I mentioned earlier.

Eric Geier founded NoWiresSecurity, which helps businesses quickly and easily protect their Wi-Fi with enterprise-level security. He's also a freelance tech writer and author of many networking and computing books, for brands like For Dummies and Cisco Press.

Eric Geier is a computing and wireless networking author and consultant. He is employed with Wireless-Nets, Ltd., a consulting firm focusing on the implementation of wireless mobile solutions and training. He is an author of Geeks on Call - Wireless Networking: 5-Minute Fixes and Geeks on Call - PC's: 5-Minute Fixes published by John Wiley & Sons.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter
Helpful Links

  • Yankee Group Mobile WAN Optimization Report

    Mobile work continues to evolve. Your organization must keep up with the demands of its mobile workforce. This report introduces the concept of mobile WAN optimization and provides three case studies including RCM, PRTM and Einstein that highlight how this emerging technology can help IT departments achieve what previously appeared to be conflicting goals. Read >

  • Network Security Resources

    More threats than ever before pose a danger to today's enterprise network. Get the latest tips and intel on the newest risks in our guide to network security resources. Read >

  • Extreme Savings: Cutting Costs with WAN Optimization

    Did you know it's possible to cut IT costs without impacting day-to-day IT operations? In fact, when you download this whitepaper from Riverbed on cost-savings through WAN optimization, you'll discover how businesses of all different sizes have realized a return on investment in just a few months through significant hard cost savings in areas such as bandwidth reduction and IT consolidation. It's called Extreme Savings and its only from Riverbed. Read >