{"id":77056,"date":"2023-06-05T13:09:08","date_gmt":"2023-06-05T17:09:08","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=77056"},"modified":"2024-02-08T13:10:04","modified_gmt":"2024-02-08T18:10:04","slug":"certificate-based-authentication-to-radius-for-admins","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins","title":{"rendered":"Certificate Based Authentication to RADIUS for Admins"},"content":{"rendered":"\n<p>JumpCloud RADIUS supports both credential (with a password) and certificate (passwordless) based authentication. Certificate Based Authentication (CBA) is considered the most secure method of authentication, with the least amount of user friction. At this time, JumpCloud is supporting certificates from multiple certificate authorities (CA). JumpCloud RADIUS allows organizations who are already using and managing certificates to import them into JumpCloud and use them for authentication to JumpCloud RADIUS.<\/p>\n\n\n\n<p><strong>Considerations<\/strong>:<\/p>\n\n\n\n<ul>\n<li>The certificate functionality allows administrators to use password credentials as a backup to certificates for user login.<\/li>\n\n\n\n<li>Using passwords as a backup for certificates gives admins the flexibility to try certificates without relying solely on them.&nbsp;<\/li>\n\n\n\n<li>MFA can be used with password credentials but not with certificates (passwordless).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Provisioning Certificates<\/h2>\n\n\n\n<ul>\n<li>Certificate Authority and root trust chain\n<ul>\n<li>JumpCloud offers the flexibility for organizations to import the root trust chain or Certificate Authority (CA)&nbsp;into JumpCloud and use them for authentication to JumpCloud RADIUS for network access.<\/li>\n\n\n\n<li>The CA may originate from a 3rd party Certificate Authority (like Globalsign) or a self-signed CA.<\/li>\n\n\n\n<li>Certificates can originate from multiple different certificate authorities which will vouch for the origin and good standing of the certificate.<\/li>\n\n\n\n<li>JumpCloud has created Powershell scripts to serve as examples of the certificate creation, generation, and import process. See&nbsp;<a target=\"_blank\" href=\"https:\/\/support.jumpcloud.com\/s\/article\/RADIUS-Certificate-Example-Scripts#distributinguser\" rel=\"noreferrer noopener\">RADIUS Certificate Example Scripts<\/a>&nbsp;for more information about using the scripts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>User Certificate types\n<ul>\n<li>JumpCloud RADIUS supports three types of User Certificates:\n<ul>\n<li>Client cert with JumpCloud user email in the subject alternative name<\/li>\n\n\n\n<li>Client cert with JumpCloud user email in the subject distinguished name<\/li>\n\n\n\n<li>Client cert with JumpCloud username in the common name<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>The user certificates must be installed on the user or local store (for example, the Current User\/Personal Store in Windows) of the target device performing the RADIUS access request.<\/li>\n\n\n\n<li>The user certificates must have been created with and derived from the CA uploaded on JumpCloud RADIUS.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Certificate Status check\n<ul>\n<li>JumpCloud RADIUS supports validating the good standing of a certificate on every authentication transaction via the Online Certificate Status Protocol (OCSP). The OCSP service providing validation on behalf of the CA&nbsp;must be specified on the User Certificate (authorityInfoAccess field must equal to OCSP followed by the URL&nbsp;identifying the resource that differentiates it from others by using a name, location, or both).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Admin Experience: Authenticating Users with Certificates<\/h2>\n\n\n\n<ol>\n<li>In the JumpCloud Admin Portal, go to the&nbsp;<strong>User Authentication &gt; RADIUS<\/strong>&nbsp;area and select the green plus (<strong>+<\/strong>) button to add a new RADIUS server.<br><img decoding=\"async\" width=\"2404\" height=\"1236\" class=\"wp-image-80770\" style=\"width: 650px\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png 2404w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server-300x154.png 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server-1024x526.png 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server-768x395.png 768w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server-1536x790.png 1536w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server-2048x1053.png 2048w\" sizes=\"(max-width: 2404px) 100vw, 2404px\" \/><\/li>\n\n\n\n<li>On the&nbsp;<strong>Authentication<\/strong>&nbsp;tab, choose JumpCloud as the Identity Provider and under the Authentication Method, click on the&nbsp;<strong>Passwordless<\/strong>&nbsp;option.\n<ul>\n<li>(optional) If desired, select&nbsp;<strong>Allow password authentication<\/strong>&nbsp;<strong>as an alternative method<\/strong>.<\/li>\n\n\n\n<li><strong>Note<\/strong>: If this checkbox is selected, admins can enable certificates for some users while allowing others to continue validating by username and password. Users will continue to have the option to validate by username and password, but once they choose to validate with certificates and a valid certificate is found, the password option will no longer be presented.<\/li>\n\n\n\n<li>Once&nbsp;<strong>Passwordless<\/strong>&nbsp;has been selected, you will not be able to&nbsp;<strong>Save<\/strong>&nbsp;until a certificate has been successfully uploaded (or the authentication method has been changed back to&nbsp;<strong>Password<\/strong>).<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\">\n<li>To upload your certificate, click on the&nbsp;<strong>Choose a File<\/strong>&nbsp;button, navigate to the file location, and select it for uploading.<br><img decoding=\"async\" width=\"444\" height=\"230\" class=\"wp-image-80772\" style=\"width: 450px\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-upload-cert.png\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-upload-cert.png 444w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-upload-cert-300x155.png 300w\" sizes=\"(max-width: 444px) 100vw, 444px\" \/><\/li>\n\n\n\n<li>Once the file has uploaded successfully the file name will display on the screen and options will change to replacing or deleting the file. There is also an option to view the full CA chain.<\/li>\n\n\n\n<li>Clicking&nbsp;<strong>Save<\/strong>&nbsp;will return the user to the main RADIUS screen, where the Certificate badge will display in the Primary Authentication column.<br><img decoding=\"async\" width=\"685\" height=\"179\" class=\"wp-image-80771\" style=\"width: 650px\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-radius-main-screen.png\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-radius-main-screen.png 685w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/04\/cert-auth-radius-radius-main-screen-300x78.png 300w\" sizes=\"(max-width: 685px) 100vw, 685px\" \/><\/li>\n<\/ol>\n\n\n\n<p><strong>User Experience<\/strong><br>When a user connects to a Wi-Fi device configured to authenticate with a certificate for the first time, the user will be able to select \u2018Connect using a certificate\u2019. On subsequent attempts the authentication will be automatic.<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>On macOS, users will need to enter their password to allow changes to Certificate Trust Settings, and to sign in and allow access to the \u201cprivate key,\u201d and should select \u201cAlways Allow\u201d when prompted.<\/p>\n <\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>JumpCloud RADIUS supports both credential (with a password) and certificate (passwordless) based authentication. Certificate Based Authentication (CBA) is considered the [&hellip;]<\/p>\n","protected":false},"author":204,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2845,2897],"support_tag":[],"coauthors":[2838],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Certificate Based Authentication to RADIUS for Admins - JumpCloud<\/title>\n<meta name=\"description\" content=\"Explore certificated based authentication to RADIUS as an admin.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Certificate Based Authentication to RADIUS for Admins\" \/>\n<meta property=\"og:description\" content=\"Explore certificated based authentication to RADIUS as an admin.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-08T18:10:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"jenniferklein\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins\",\"url\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins\",\"name\":\"Certificate Based Authentication to RADIUS for Admins - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png\",\"datePublished\":\"2023-06-05T17:09:08+00:00\",\"dateModified\":\"2024-02-08T18:10:04+00:00\",\"description\":\"Explore certificated based authentication to RADIUS as an admin.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Certificate Based Authentication to RADIUS for Admins\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Certificate Based Authentication to RADIUS for Admins - JumpCloud","description":"Explore certificated based authentication to RADIUS as an admin.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins","og_locale":"en_US","og_type":"article","og_title":"Certificate Based Authentication to RADIUS for Admins","og_description":"Explore certificated based authentication to RADIUS as an admin.","og_url":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins","og_site_name":"JumpCloud","article_modified_time":"2024-02-08T18:10:04+00:00","og_image":[{"url":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes","Written by":"jenniferklein"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins","url":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins","name":"Certificate Based Authentication to RADIUS for Admins - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png","datePublished":"2023-06-05T17:09:08+00:00","dateModified":"2024-02-08T18:10:04+00:00","description":"Explore certificated based authentication to RADIUS as an admin.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#primaryimage","url":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png","contentUrl":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/04\/cert-auth-radius-new-server.png"},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/certificate-based-authentication-to-radius-for-admins#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Certificate Based Authentication to RADIUS for Admins"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/77056"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/204"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/77056\/revisions"}],"predecessor-version":[{"id":105582,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/77056\/revisions\/105582"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=77056"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=77056"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=77056"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=77056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}