Launching Certificate-Based Security Shouldn’t be Intimidating

“Global spending on information security and risk management is expected to grow 14.3% in 2025 to reach $212 billion.”

Source: Gartner Press Release, August 28, 2024

Implementing strong network security is essential. But, necessary is also complex since deploying and managing components like Public Key Infrastructure (PKI), Remote Authentication Dial-In User Service (RADIUS), Intune, Jamf, Simple Certificate Enrollment Protocol (SCEP), or Automatic Certificate Management Environment (ACME) have shown. IT teams often face challenges such as failed certificate installs, misconfigured device profiles, operational overhead, and frustrating RADIUS rejections. And this is harder to manage when your network continues to grow.

Are you actively deploying or troubleshooting certificate-based infrastructure? Let’s walk you through ways to streamline certificate enrollment and authentication using modern tools.

How to Deploy EAP-TLS with WPA2-Enterprise

Configure the RADIUS Server

Migrating to a secure WPA2-Enterprise network using EAP-TLS starts with properly configuring a RADIUS server that integrates with Microsoft Entra ID (formerly known as Azure AD). A RADIUS server handles authentication requests when users or devices attempt to connect to the network. With EAP-TLS, it verifies certificate validity instead of passwords, which are much more secure and user-friendly. The RADIUS server validates the certificate’s authenticity, ensuring it hasn’t expired or been revoked, and checks in real-time whether the user/device is still active in Azure AD. You can choose between different options like:

• FreeRADIUS (open-source but requires extensive manual configuration)
• Microsoft NPS with Azure AD extension (limited to hybrid environments)
• Cloud RADIUS solutions like SecureW2, which offer turnkey integrations with Entra ID and dynamic policy enforcement.

As you configure RADIUS, watch for common EAP-TLS failure points like expired certificates, missing intermediate CAs, or incorrect EAP-TLS settings. Identifying them at an early stage can save you hours of troubleshooting down the line.

Set Up the PKI

Setting up a PKI strengthens your network perimeter, which helps in the issuance, management, and validation of digital certificates. To set up a PKI, you need to have one or more CAs, defined certificate templates, enrollment mechanisms, and a configured  RADIUS server.

Use a private CA that gives you control over:

• Who receives a certificate (devices, users, BYOD)
• How certificates are issued (automatic vs. manual)
• Certificate lifetimes, revocation policies, and renewal mechanisms

Enroll and Manage Certificates

Once users have certificates, you can begin enrolling devices and users. Pro tip: Consider using automated protocols, since manual certificate enrollment doesn’t scale.

Use tools like ACME for cloud-native workflows supporting automatic certificate issuance and renewal.

 

Example: Apple Device Certificate Enrollment via ACME

The SecureW2 JoinNow platform supports ACME with Apple devices, and it integrates seamlessly with most major MDMs, including Jamf, Addigy, Kandji, and others.

To set up ACME in SecureW2:

1. Create a new Intermediate CA
2. Create a Certificate Template
3. Set up ACME-based device attestation using a Key Attestation Provider
4. Generate an API token
5. Create an Identity Lookup Provider
6. Policy Management

You can find a detailed walkthrough in our ACME configuration guide.

You can also configure SCEP for Intune or Jamf, which helps distribute device and user certificates on managed endpoints.

Example: Using SCEP with Intune

1. Admin targets the SCEP profile to the mobile device via Intune.
2. The device sends a CSR to the third-party SCEP server.
3. SCEP server requests a token from Azure AD for authentication.
4. Azure AD sends back the token to the SCEP server.
5. SCEP server authenticates to Intune with the token and CSR.
6. Intune verifies the challenge and approves the request.
7. The certificate is issued silently to the device without any user interaction.

Although configuring SCEP with Intune requires no user interaction, it isn’t the only other choice.

We also offer Dynamic SCEP in specific configurations, which is a more secure alternative to SCEP. Unlike static challenge secrets that can be reused or intercepted, Dynamic SCEP generates a unique, one-time-use password for each certificate request, significantly reducing the attack surface. While most of our deployments use SCEP, Dynamic SCEP requires configuration in an MDM and ensures that only trusted devices and authorized users can authenticate themselves to a network.

Below is a comparative table that will help you choose between SCEP and ACME in 2025.

Feature	ACME	SCEP
Purpose	Automates certificate issuance and renewal for services/servers	Automates certificate enrollment for devices/users
Use Case	Web servers, APIs, cloud-native apps, and dynamic workloads	Ideal for MDMs like Intune, Jamf, 802.1X, VPN, Wi-Fi onboarding
Validation	Domain ownership (HTTP/DNS)	Shared secret or challenge password
Automation	Fully automated	Partial (via MDM/onboarding tools)
Security Level	High (short-lived certs, DV)	Moderate
Public CA	Common	Rarely Used
Private CA	Increasing support	Widely supported
Best for	TLS/SSL for websites, microservices	Enterprise Wi-Fi, VPN, 802.1X

Device Onboarding Options

Next is properly configuring user devices for WPA2-Enterprise, a step where many organizations can very easily get it wrong. Even a small misconfiguration can expose users to credential theft, man-in-the-middle attacks, or unauthorized access.

There are two major onboarding options, i.e., managed and unmanaged devices:

Managed devices (MDM-Integrated) – These are company-owned devices, like laptops or phones, which are managed using specialized IT tools called Mobile Device Management (MDM) systems. In this case, the onboarding process is invisible, where the Wi-Fi settings, certificates, security rules, etc, are all set up automatically without any user interaction.

We provide automated gateway APIs that integrate with your MDM. These APIs push the correct Wi-Fi configuration and certificate directly to the device and are fast, scalable, and policy-compliant by design.

Unmanaged Devices (BYOD) – This is where users use their personal devices. In the Bring Your Own Device (BYOD) environment, the company doesn’t control the devices.

Instead, users have to use an onboarding app like  JoinNow MultiOS, specially designed for unmanaged devices, and that works across all platforms. In this case, the user needs to sign in once with their Identity Provider (IDP) credentials, and the app handles everything else, like getting the certificate, installing it, and setting up secure Wi-Fi access.

Group Policies and Network Segmentation

Once users are enrolled, you can set group policies to control access based on certificate attributes. It also helps segment devices/users by department, privilege level, or compliance status to ensure that the policies are available to specified groups.

Managing the Certificate Lifecycle

While WPA2-Enterprise can use passwords, we recommend a certificate-based, passwordless approach, where proper certificate management becomes essential. Our Gateway APIs automate certificate enrollment and renewal through SCEP, JSON, and OAuth, eliminating the need for end-user interaction. There may be situations that require prematurely revoking certificates, which are automated with some MDMs, such as JAMF and Intune. You can also create custom policies for a definable period of time, which automatically revoke certificates, which are added to a Certificate Revocation List (CRL).

The network is fully operational and ready to distribute certificates and authenticate users.

Common Deployment Mistakes (and How to Avoid Them)

Duplicate or Misconfigured Certificate Templates

Incorrect templates lead to enrollment failures or certificates issued without the necessary fields. They can prevent users from authenticating or breaking integration with RADIUS or MDM tools.

Fix: Standardize templates for users/devices; verify key usages and subject fields.

Intermediate CAs Not Published

Clients or RADIUS servers may not trust certificates without a complete chain of trust. This causes authentication failures even if the end-entity certificate is valid.

Fix: Publish and deploy intermediate CA certificates to all devices.

Inactive or Compromised Certificates Not Revoked

Expired or unused certificates can still allow access if not explicitly revoked, which might lead to risk from compromised or lost devices.

Fix: Regularly revoke old certs using CRL or OCSP, or you can also automate the cleanup process using identity lookup tools.

Fallback to PEAP/MSCHAPv2 is Still Enabled

Users or systems may still use legacy authentication methods, which weakens the network’s security posture and exposes credentials.

Fix: Disable insecure EAP types on all SSIDs; enforce EAP-TLS only.

RADIUS Certificate Rejection

RADIUS denies authentication because the client certificate issuer isn’t trusted.

Fix: Ensure the server CA certificate is in the RADIUS trust store; verify that the client certificate includes the SAN with the user/device identity.

SCEP Enrollment Failures

There are a few issues that you may encounter after the configuration is done. The connection to the secure SSID fails, or error messages are displayed, such as “Device Creation Failed” or “SCEP enrollment failed”. These typically occur when firewall rules block traffic, bad permissions, or connectors are misconfigured.

Fix: Check if SCEP profile attributes are mapped correctly, like DeviceName and AAD_Device_ID. Verify the SCEP profile in Intune is configured accurately and ensure that the users are correctly added to Intune and licensed.

802.1X Misconfigurations

Clients can’t complete the authentication handshake due to wrong EAP settings. Incorrect EAP type or disabled cert validation is common.

Fix: Review supplicant settings (e.g., server certificate validation enabled, correct EAP type selected).

Tools for Certificate Onboarding in 2025

When it comes to launching certificate-based security, what you choose for onboarding plays a critical role in ensuring scalability, security, and a seamless user experience. These onboarding tools are classified into two primary categories:

1. Certificate Onboarding Solutions, and
2. Mobile Device Management (MDM) Platforms

Certificate Onboarding Solutions

These tools handle the certificate lifecycle from enrollment and distribution to renewal and revocation. They integrate easily with your identity providers (IDP) and MDMs, simplifying the process across device types.

SecureW2 Dynamic PKI

• Cloud-native solution that integrates with all major MDMs like Intune, Jamf, Google MDM, etc.
• Simplifies SCEP/ACME setup with pre-configured templates.
• Supports JoinNow MultiOS for secure BYOD onboarding across all platforms
• Integrates with Entra ID, Okta, Google Workspace, and more.
• Offers real-time visibility, revocation, and reporting dashboards.
• Offers API gateways for automated certificate issuance to managed devices.

MDM Platforms

MDMs aren’t certificate authorities, but they help distribute certificate profiles and Wi-Fi configurations to managed devices.

Microsoft Intune

• Supports both SCEP and PKCS certificate enrollment.
• Automates Trusted Root and SCEP profile deployment to devices.
• View logs via Endpoint Manager or Event Viewer.
• Use dynamic Entra ID device groups to target deployment.
• Set auto-renewal and key usage policies via certificate templates.

Jamf

• Fully compatible with SecureW2 SCEP and ACME gateways.
• Enables silent certificate deployment on macOS and iOS.
• Can scope profiles to Smart Groups based on device inventory.
• View logs using the Jamf console and system logs on devices.

Google MDM

• Supports SCEP via configuration profiles.
• Works for Android Enterprise, ChromeOS, and Google Pixel devices.
• Supports Zero-Touch Enrollment for Android.
• Great for BYOD and Chromebook environments.

Smart Certificate Deployment

Deploying certificate-based infrastructure might seem intimidating, but it’s the best for secure, passwordless access. However, the real challenge is deployment in larger environments without breaking user workflows or overwhelming the IT teams with support tickets.

With protocols like SCEP, ACME, and modern MDMs, you can automate certificate lifecycle management, reduce support tickets, and harden your network security.

Solutions like SecureW2 eliminate the complexity by:

• Providing native integrations with Intune, Jamf, Google MDM, and more.
• Automating certificate issuance using SCEP or ACME gateways.
• Enabling silent deployments with zero user involvement.
• Offering real-time visibility, revocation controls, and complete PKI lifecycle management.

These solutions plug into your current stack, making certificate-based security scalable and policy-compliant.

Visit SecureW2 ‘s pricing section and get tailored options for organizations of all scales and sizes.