A RADIUS server has a self-signed certificate for radius.example.com
. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?)
- The self-signed certificate is installed on all client computers using Group Policy (through Security Settings > Public Key Policies/Trusted Root Certification Authorities).
- In Network Authentication Method Properties (on Wireless Network (802.11) Policies, IEEE 802.1X Settings) validating this certificate is enforced by applying these settings for the SSID:
- Authentication method:
Protected EAP (PEAP)
- Validate server certificate:
Enabled
- Connect to these servers:
radius\.example\.com
- Trusted Root Certification Authorities:
[x] radius.example.com
(alone) - Do not prompt user to authorize new servers or trusted certification authorities
Enabled
.
- Authentication method:
It's assumed that clients wouldn't authenticate against any RADIUS servers not signed by the radius.example.com
on any evil twin AP scenarios. However, this is hard to verify from the Windows 10 GUI, as it only says that "Some settings are hidden or managed by your organization" and doesn't show in detail what settings are applied.
What would be the simplest method to verify that client computers are really validating the certificate? RSoP shows that the GPO itself is applied. The certificate is in its place (certmgr.msc
).