Okay so it's Tunneled TLS

All I got was this:

EAP-TTLS Authentication Protocol. EAP-TTLS (Tunneled Transport Layer Security) is designed to provide authentication that is as strong as EAP-TLS, but it does not require that each user be issued a certificate. Instead, only the authentication servers are issued certificates. The authentication server's certificate is used to establish a tunnel between the user and the server. After the tunnel is established, credentials can be exchanged safely between the server and the user because tunnels encrypt all data in a secure fashion. This stage is called inner authentication.

What I don't understand why if it's Tunneled does that mean that clients don't need certificates anymore? Isn't the certificate needed for the client to prove who he is?

1 Answer 1


In EAP-TTLS, the tunnel is established with no authentication. Once the tunnel is established and secure communication possible, any means of authentication, such as AD credentials, can be used.

The certificate is used to establish a secure connection over a public channel, where the certificate is used to confirm the server's identity.

Once this channel has been established, the client knows it has connected to an authentication server, but the server has no idea who it is talking to.

Therefore, a second round of authentication, called the "inner authentication" is used to establish the identity of the client. The inner authentication can be done with AD, RADIUS, or any other authentication method.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .