I'm looking at securing a wi-fi network used in an industrial context. I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). These clients are all "devices" with no interactive user interface, and therefore must connect automatically. Some supplicants are Debian-based Linux, others are Espressif ESP32 microcontrollers. I need to determine what authentication strategy should be used and how the credentials should be managed in the long term.
Looking at the supported protocol list on the various hardware that I have, it looks like WPA3-Personal and WPA2-Enterprise are both supported.
WPA2-Enterprise with EAP-TLS authentication to a RADIUS server seems more suitable at first glance (per-connection encryption PMK, no pre-shared key, mutual authentication with different secrets on either side), but I'm unclear on the detailed requirements for the EAP-TLS certificates.
These wireless networks are intended to be purely private WLANs, with no route to the Internet. Therefore, I intend to set up a private root CA and intermediate CAs and distribute the root & intermediate public key certs to the client devices manually, as part of their initial software loadout, rather than using certs from a commercial authority. I'm not yet certain whether there will be a DNS server inside the WLAN; I think I could use static private IPs for all the services that the clients will need to talk to, and for the AP-to-RADIUS connection, but I could set up a private local DNS if necessary.
Microsoft documentation seems to say that for the Windows Server implementation of EAP-TLS, the server certificate must specify a particular Fully Qualified Domain Name, and the client certificates must specify a particular (AD?) user identity. Is it possible to use Windows Server's RADIUS/EAP-TLS implementation outside the context of an AD domain infrastructure?
Does EAP-TLS in general require that the server certificates be bound to specific domain names, or that the client certificates be bound to unique user identities?
What about non-MS EAP-TLS implementations? If I run a Linux RADIUS server with EAP-TLS, what does the EAP-TLS server certificate need to actually certify? Can it be configured to present a generic server certificate without a specific server identity, simply relying on the existence of the intermediate & root certificates in the client's certificate store to provide adequate authentication?
Likewise, can a single generic EAP-TLS client certificate be deployed to all the clients and validated by the RADIUS server?