EAP-TLS for securing internal local WLAN?

Question

I'm looking at securing a wi-fi network used in an industrial context. I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). These clients are all "devices" with no interactive user interface, and therefore must connect automatically. Some supplicants are Debian-based Linux, others are Espressif ESP32 microcontrollers. I need to determine what authentication strategy should be used and how the credentials should be managed in the long term.

Looking at the supported protocol list on the various hardware that I have, it looks like WPA3-Personal and WPA2-Enterprise are both supported.

WPA2-Enterprise with EAP-TLS authentication to a RADIUS server seems more suitable at first glance (per-connection encryption PMK, no pre-shared key, mutual authentication with different secrets on either side), but I'm unclear on the detailed requirements for the EAP-TLS certificates.

These wireless networks are intended to be purely private WLANs, with no route to the Internet. Therefore, I intend to set up a private root CA and intermediate CAs and distribute the root & intermediate public key certs to the client devices manually, as part of their initial software loadout, rather than using certs from a commercial authority. I'm not yet certain whether there will be a DNS server inside the WLAN; I think I could use static private IPs for all the services that the clients will need to talk to, and for the AP-to-RADIUS connection, but I could set up a private local DNS if necessary.

Microsoft documentation seems to say that for the Windows Server implementation of EAP-TLS, the server certificate must specify a particular Fully Qualified Domain Name, and the client certificates must specify a particular (AD?) user identity. Is it possible to use Windows Server's RADIUS/EAP-TLS implementation outside the context of an AD domain infrastructure?

Does EAP-TLS in general require that the server certificates be bound to specific domain names, or that the client certificates be bound to unique user identities?

What about non-MS EAP-TLS implementations? If I run a Linux RADIUS server with EAP-TLS, what does the EAP-TLS server certificate need to actually certify? Can it be configured to present a generic server certificate without a specific server identity, simply relying on the existence of the intermediate & root certificates in the client's certificate store to provide adequate authentication?

Likewise, can a single generic EAP-TLS client certificate be deployed to all the clients and validated by the RADIUS server?

Answer 1

WPA2-Enterprise with EAP-TLS authentication to a RADIUS server seems more suitable at first glance (per-connection encryption PMK, no pre-shared key, mutual authentication with different secrets on either side)

In WPA3-SAE (WPA3-personal), the PMK is per connection as well (which prevents passive eavesdropping): however any station can use the shared passphrase to impersonate the AP. When combined with password identifiers, you can have a different passphrase for each device which prevents this problem.

Does EAP-TLS in general require that the server certificates be bound to specific domain names, or that the client certificates be bound to unique user identities?

The server identity is found in the server certificate. This server identity should be provisioned in the stations.

Using unique user/station identities can allow you to add some additional constraints (VLAN, etc.) and can help you revoking some accesses in case one device is broken/decommissioned/compromised.

Can it be configured to present a generic server certificate without a specific server identity, simply relying on the existence of the intermediate & root certificates in the client's certificate store to provide adequate authentication?

In general it can. Using wpa_supplicant, you can use the domain_match option to validate the server host name against some value. You should use this option or a similar one unless your stations are configured to use a dedicated CA (which is not used for any other server):

A WPA3 STA shall, when performing an EAP exchange with one of the above EAP methods, determine that server certificate validation has failed if none of the following are true

1. The STA is configured with EAP credentials that include a server certificate that is exactly equal to the certificate in the received Server Certificate message.
2. The STA is configured with EAP credentials that explicitly specify a CA root certificate that matches the root certificate in the received Server Certificate message and, if the EAP credentials also include a domain name (FQDN or suffix-only), it matches the domain name (SubjectAltName dNSName if present, otherwise SubjectName CN) of the certificate [2] in the received Server Certificate message.
3. The STA is configured with EAP credentials that include a domain name (FQDN or suffix-only) that matches the domain name (SubjectAltName dNSName if present, otherwise SubjectName CN) of the certificate [2] in the received Server Certificate message, and the root certificate of that certificate is present in the STA's trust root store

I would advise to always validate the server name.

Likewise, can a single generic EAP-TLS client certificate be deployed to all the clients and validated by the RADIUS server?

It should work but then you would not be able to revoke the access of a broken/decommissioned/compromised station.