@@apalrdsadventures 1 question, can i use network security appliance certificate? eg: sophos? since i alredy have the appliance, ill use that certificate instead, it has many years before it expires
Link-level security has its value (such as for identity protection), but you are trusting the AP - this might make sense at home, but not in public. Therefore, end-to-end security is always necessary. I argued this in the 802.11 standards group many years ago in the context of mesh networks, where you might have great link-level encryption, but have to trust an unknown set of intermediate nodes.
In which use cases would Smallstep not be useful when implementing EAP-TLS? I presume one answer would be when only securing local connections in a network segment that doesn't have internet access at all. Is that correct? Are there other uses cases where Smallstep is not necessary or perhaps even a disadvantage?
Depends on if you mean Smallstep SaaS or step-ca (the open-source backend). You can use the open-source backend along with FreeRADIUS to implement everything in this video, except generating mobileconfig files. They are just xml though, and step-ca can do the SCEP bit. So Smallstep (SaaS) is adding a GUI in this case, and also doing the job of configuring FreeRADIUS. Step-CA (open-source backend) is adding a ton of plumbing above what OpenSSL would provide as a CA, especially in supporting enrollment protocols like SCEP, ACME, Nebula, and integrating other types of certs like TLS and SSH into the same system.
Excellent video, thank you so much! Have you found any way to automatically distribute generated certificates on iOS devices? I'm pretty sure my wife won't be happy if I ask her to do that every 3 months 😕
Camera security? Are you aware of any open-source camera firmware that supports EAP-TLS Certificate security so that security cameras can't be eaves-dropped on?
Okay, so I plan on investigating the github projects ESP32-EAP-TLS-WPA2 and ESP32-CAMERA at some point. Hopefully they will work together well enough to make a much more secure security camera.
RADIUS-side you can use a single self-signed cert if you want, or it can be issued by an authority clients trust. Client-side you need an authority to issue certs and then the RADIUS server trusts the authority to validate individual certs. OpenSSL can do this (but it's clunky), and step-ca (the open source backend of Smallstep) can also do this self-hosted. FreeRADIUS would then be configured with the eap module and point at the root certificate used by the clients. The authority doesn't need to be public, but you really do need an authority somewhere.
@@apalrdsadventures Great 👍, thanks. Id rather spend a few hours figuring this out and writing rudimentary bash scripts to automate it with cron than to scramble when the external provider goes under......
I've just set this up using my own RootCA for the smallstep PKI. anyone happen to know if you stay under the 20 device cap is it still free? I can see my authorities type is Advanced?
Security / 802.11 settings are separate. You can run in WPA2/3 transition and allow clients of either generation, and separately allow 802.11N/AC/AX (on 5Ghz). In WPA-Enterprise, using WPA2/3 transition doesn't have nearly as many downsides as it does in WPA-PSK.