We're planning to move away from a shared Wi-Fi password and implement certificate-based 802.1X authentication. Our environment is hybrid AD and Entra ID with Entra Connect. We use Ruckus access points managed through Virtual SmartZone, an FSSO agent for access control across VLANs, FortiGuest for guest Wi-Fi, FortiGate firewalls, and Ninja for RMM and MDM.
Would an on-premises RADIUS server such as Microsoft NPS be a sensible choice? If we use EAP-TLS, what is the recommended way to issue and manage certificates on Windows, iOS, and Android devices?
5 Answers
If your devices are managed through Intune, a cloud PKI and cloud RADIUS service may be much easier to operate. Intune can deploy the Wi-Fi profile and certificates, while the cloud service handles authentication without requiring you to maintain an on-premises CA and RADIUS stack. There are several vendors offering SCEP-based PKI and hosted RADIUS solutions.
A common on-premises design is to deploy an internal certificate authority integrated with Active Directory, use NPS as the RADIUS server, and issue computer certificates through Group Policy. The Wi-Fi clients then authenticate with those certificates instead of a shared password. This works especially well for domain-joined Windows devices.
For iOS and Android, avoid relying on manual certificate installation if you have more than a handful of devices. Use your MDM to deploy the trusted CA certificate, client certificate, and 802.1X Wi-Fi profile. SCEP or another automated certificate enrollment method can handle renewal. An Azure-native PKI combined with hosted RADIUS is another option, particularly if you only need straightforward authentication.
NPS with an on-premises CA is a reasonable choice if most endpoints are hybrid-joined or joined to local AD. The difficult part is Entra-only Windows and Mac devices, since they do not naturally map to traditional AD computer accounts. Intune certificate profiles, SCEP, or a third-party PKI connector can help, but the Wi-Fi profile and certificate enrollment process often require careful testing.
You could also evaluate a NAC platform or a Ruckus-oriented certificate onboarding product. These can simplify device enrollment and VLAN assignment, though the licensing cost may be significant. Make sure the solution supports dynamic VLANs if you need employees, unmanaged devices, and special device types separated by policy.
I’m considering a NAC product because we’re also moving toward more Fortinet switching, but I’m concerned about the licensing cost. My main unresolved issue is finding a clean way to manage certificates on Android and iOS devices.
A cloud approach is worth considering here. The local setup is possible, but cloud services usually reduce maintenance and tend to work better as more devices become Entra-only.