Update RADIUS Certificates for EAP-TTLS Devices

JumpCloud's RADIUS-as-a-Service offers Certificate-based methods for desktops, laptops, and mobile devices to verify that they are authenticating to the correct RADIUS server (so that no one else can pretend to be JumpCloud's RADIUS server). This will prevent clients from trusting RADIUS servers without the Private Key that matches this Certificate. JumpCloud strongly recommends that you leverage a certificate authentication method for this reason.

This help article explains how to update and deploy the new JumpCloud RADIUS certificate to both Windows and Mac devices.

Most clients using PEAP do not need to manually add the RADIUS certificate because it is automatically acquired during the device authentication process.

Considerations:

• If you have the current JumpCloud RADIUS certificate installed, you only need to update where it was manually installed.
• You can install the new certificate side-by-side with the current (expired) certificate. The system will select the correct certificate.
• To avoid service disruptions, do not remove the current (expired) certificate until it is replaced on July 8, 2024.
• The EAP-PEAP protocol is not affected by the RADIUS certificate expiration. However, users may be prompted to grant trust to the new certificate when they connect to JumpCloud managed EAP-PEAP RADIUS servers.
• If this is your first time configuring a client system for EAP-TTLS/PAP, please instead refer to the following documents for guidance on initial setup:
  • EAP-TTLS/PAP Initial Configuration on Windows for JumpCloud RADIUS clients
  • EAP-TTLS/PAP Initial Configuration on Mac & iOS Devices for JumpCloud RADIUS clients

Mac Setup

To update the JumpCloud RADIUS certificate in macOS:

1. Download the attached .mobileconfig file and open it in a text editor.

2. Add the Service Set Identifier (SSID) in between the <string> and </string> text on Line 43.
3. Log in to the JumpCloud Admin Portal: https://console.jumpcloud.com/login.
4. Go to Device Management > Policy Management
5. In the All tab, click the plus icon.
6. On the New Policy panel, select the Mac tab.
7. Select MDM Custom Configuration Profile policy from the list, then click configure.
   

8. (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
9. In the Settings field, click upload file to upload the modified .mobileconfig file.
10. (Optional) Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
11. (Optional) Select the Devices tab. Select one or more devices where you want to apply this policy.
12. Click Save. If prompted, click Save again.

Windows Setup

To update the JumpCloud RADIUS certificate in Windows 10:

1. Log in to the JumpCloud Admin Portal: https://console.jumpcloud.com/login.
2. Go to Device Management > Commands.
3. In the Commands tab, click the plus icon to create a new command.
4. In the Details tab, enter a name in the Name field.
5. In the Name field, enter a name for your command.
6. In the Type field, select Windows, then select the Windows Powershell checkbox.
7. In the Command* field, copy and paste the contents of the attached radius_cert_install-2024.ps1 file.

8. In the Event field, select an event type. The standard default is Run Manually.

9. (Optional) Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
10. (Optional) Select the Devices tab. Select one or more devices where you want to apply this policy.
11. Click Save. If prompted, click Save again.

Alternatively, you can download and import the new certificate manually from the command line, as shown in the following example:

Wireless Network Configuration 

To configure your wireless network:

1. Right-click the wireless network that was previously configured using EAP-TTLS/PAP configuration on Windows for JumpCloud RADIUS clients, then select Properties.
2. Click the Security tab.
3. Next to the authentication method, click Settings.
4. From the Trusted Root Certification Authorities, ensure that both the existing radius.jumpcloud.com and the new imported certificate are selected.
5. Click OK.

Reference Files

As a reference, the Mac and Windows commands, as well as the new certificate and its signature can be obtained here:

• JumpCloud RADIUS Apple Mobile Config File (2023-2025)
• JumpCloud RADIUS Windows Cert Install PowerShell Script (2024)
• JumpCloud RADIUS Certificate download
  • JumpCloud RADIUS Certificate MD5 Signature download