RadSec
Requirements
Before your access points are able to establish a valid RadSec connection (which can be considered an mTLS connection), there are requirements that must be met, regardless of which manufacturer your access points originates from.
Access Points require a valid client certificate (typically referred to as "RadSec Client Certificate" or "RadSec Certificate"). This client certificate must have the EKU Client Authentication (1.3.6.1.5.5.7.3.2) and not Server Authentication.
Access Points must trust the CA that has issued your RADIUS Server Certificate.
RADIUSaaS must trust the CA that has issued the RadSec client certificate on your access points.
Some access points (counterintuitively) still require a shared secret when RadSec is configured. The RadSec RFC defines that a static and pre-define value must be used for this: "radsec".
Last updated