The OP in this thread: Why is a CA certificate required for EAP-TLS clients?

said " My RADIUS server uses wifi-server-cert as the SSL certificate, and uses the wifi-client-ca certificate authority for validating client certificates."

Can someone tell me:

!/ Is it necessary (or advantageous) to use both a Server certificate and a CA Certificate on a Radius Server.(or do I have my wires crossed!)

2/ And if so how is it arranged?

At the moment I'm trying to set up an iPad to connect via WPA 2 Enterprise EAP-TLS.

I'm using a Qnap Network Attached Storage unit that has a radius server option. It will accept a certificate and key, plus an intermediate certificate - all in ascii format.

I'm using Openssl via XCA gui to create self signed certificates.

So far the only way I can find to get it to work is to have Root CA on the Radius Server. Client Certificate and key (p.12 Chained) plus Root CA certificate (.cer) in the Apple ios profile for the iPad.

3/ So also is it a security risk to use the root CA on the Radius Server?


The CA certificate is only being used to establish a mutually trusted certificate authority for both the client and server. This allows each to know the other is not a malicious impersonator.

  1. The RADIUS server needs a CA certificate to be able to check all the connecting clients are trusted by the CA. It will also have a separate certificate and private key which it will use when communicating.
  2. This is done by placing the CA certificate and server certificate on the server. The client will present a cert signed by the CA. (Either directly or through intermediate CAs). The server will check the signature to verify this is correct and accept the connection.

  3. Simply leaving the root certificate around isn't a security risk. It is a public key, meant to be shown to outside parties so they can check a CA signature is genuine. However, using the root certificate for communication requires having the private key available. This key is very security sensitive and shouldn't be easily accessed. Using it for a radius server is a major security risk.

  • This is correct, though note the key point here is that you should be putting the Root CA public key into the RADIUS server, not the private key (probably actually a bundle since most people don't sign with the Root CA but rather with an intermediate CA, so you will likely have a PEM file with two certs in it, the intermediate's public key and the root's public key) – crovers Oct 11 '16 at 12:54
  • @ztk Thanks for the very concise answer.Thats a great help.So is there ever a need for the root CA Private Key to be on the radius server? In any other role perhaps? – Mark Owen Oct 11 '16 at 16:04
  • @crovers Thanks for your help. So best practice would be to build the root CA, sign a CA certificate (intermediate) with it. And use that intermediate to sign the server and client certs.Put the (chained) CA certificate/public key on the Radius server (without the private key) + the server certificate and Private key ? – Mark Owen Oct 11 '16 at 16:06
  • @MarkOwen Seems like you got it, yes – crovers Oct 11 '16 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.