Implement PKIaaS with RADIUS for Certificate-Based Wi-Fi

Public Key Infrastructure as a Service (PKIaaS) in JumpCloud issues user certificates from a JumpCloud-managed Certificate Authority (CA). Pair it with JumpCloud Remote Authentication Dial-In User Service (RADIUS) to authenticate Wi-Fi with certificates over Extensible Authentication Protocol Transport Layer Security (EAP-TLS) instead of passwords.

Prerequisites

• Admin Portal access to Certificate Authority, RADIUS, and Policy Management.
• A JumpCloud-managed Client Certificate Authority under Security > Certificate Authority > Root Certificates. See Certificate Authority Management to learn more.
• A RADIUS server under Access > RADIUS configured with Passwordless authentication and the same CA root uploaded. See RADIUS Configuration and Authentication to learn more.
• Windows 10 or Windows 11 devices enrolled in JumpCloud MDM.
• A WAP or router that supports RADIUS and EAP-TLS.

Considerations

• Passwordless RADIUS requires EAP-TLS. MFA applies to password-based RADIUS only, not certificate auth.
• The SCEP challenge password is shown once at endpoint creation. Copy it before you click Close.
• Deploy the root CA through an Install Certificate policy or through SCEP, not both. This article uses a separate Install Root Certificate policy.
• Windows user-scoped MDM policies are in Private Preview. Confirm your tenant has access.
• SCEP and RADIUS hostnames are region-specific. See JumpCloud Data Centers for your tenant.

Create a JumpCloud-Managed Root Certificate

JumpCloud provisions a Client Certificate Authority instantly from the Admin Portal. You use this root in your RADIUS server and in every certificate delivery path below. See Certificate Authority Management to learn more.

Configure RADIUS for Passwordless Authentication

Do the following to configure RADIUS:

1. Go to Access > RADIUS and click (+ Add).
2. On the Details tab, enter Server Name, Shared Secret, and IP Addresses. Click Save.

3. On the Authentication tab, select JumpCloud and Passwordless.
4. Upload the CA root certificate file.
5. Click Save. A Certificate badge appears in the RADIUS list.
6. On the User Groups tab, select the groups that should use this server. Click Save.

Create a JumpCloud PKI SCEP Endpoint

1. Log in to the JumpCloud Admin Portal.

2. Go to Security > Certificate Authority > SCEP Endpoints.
3. Click + Add SCEP Endpoint.

4. Enter a SCEP Name, select profile Users, and choose the Client Certificate Authority.
5. Click Next.

6. Copy the Challenge Password.
7. Click Create.

See Manage SCEP Endpoints to learn more.

Distributing Certificates

Choose one or more paths depending on how your users and devices are managed.

Path A: Automate with MDM Policies

Use this path for Windows devices enrolled in JumpCloud MDM. JumpCloud pushes the root CA, issues a user certificate through SCEP, and deploys a Wi-Fi profile that automatically selects the certificate present on the device.

• Create an Install Root Certificate Policy - Deploy the CA root to the user certificate store before SCEP enrollment. See Create a User Level Windows Install Certificate Policy or Create a Device Level Windows Install Certificate Policy to learn more.

• Create a User Certificate Issuance Policy - This step runs after the SCEP endpoint and Install Root Certificate policy. When a user signs in, JumpCloud pushes a user-scoped SCEP profile and the device stores the certificate in the Current User store. See Create a User Level Windows SCEP Profile Policy and Create a Device Level Windows SCEP Profiles Policy to learn more.

• Validate Device and User Association - Confirm the user, device, and policies are aligned before you deploy Wi-Fi:
  • Verify the target user is Active in JumpCloud and belongs to the user groups assigned while creating a Install Root Certificate and User Certificate Issuance policies.
  • Verify the target Windows device is enrolled in JumpCloud MDM and has the JumpCloud Agent running.
  • Have the user sign in to the managed Windows device. The Agent detects the session and pushes user-scoped policies.
  • On each Install Root Certificate policy and User Certificate Issuance policy, open the Status tab and confirm Exit Status is 0 for the target device.

• Create a Wi-Fi Policy - Deploy the Wi-Fi profile after the user certificate is issued. The device uses EAP-TLS and the SCEP-issued certificate to connect to your RADIUS-protected SSID. See Create a User Level Windows WiFi Configuration Policy and Create a Device Level Windows WiFi Configuration Policy to learn more.

Path B: Manually Distribute Certificates (Non-MDM Devices)

Use this path for devices that JumpCloud MDM cannot reach. The admin downloads the certificate from the Admin Portal and distributes it manually.

1. Go to Security > Certificate Authority.
2. Locate the issued user or device certificate.
3. Download the certificate.
4. Install the certificate on the target device using your operating system method.
5. Configure the Wi-Fi profile on the device to use EAP-TLS with that certificate and the SSID protected by your JumpCloud RADIUS server.

Path C: Enable User Portal Certificate Download

Use this path when you want users to download and install their own certificates without MDM enrollment.

1. Enable User Portal certificate generation for your organization or user group.
2. Direct users to the User Portal.
3. Users download their certificate from the User Portal.
4. Users install the certificate and connect to the RADIUS-protected SSID using EAP-TLS.

See User-Initiated Certificate Generation to learn more.

Configure Your WAP

On your WAP or router:

1. Point RADIUS at JumpCloud (radius.jumpcloud.com or your region FQDN) on port 1812/UDP.
2. Enter the Shared Secret from your RADIUS Details tab.
3. Set the SSID to WPA2-Enterprise or WPA3-Enterprise with EAP-TLS.

See Configure a WAP, VPN, or Router for RADIUS to learn more.

Once you have followed all the above mentioned steps, you will be able to implement PKIaaS with RADIUS for Certificate-Based Wi-Fi.