I85PREP
⌘ K
CWSR study materials
CWSR study resources

CWSR: RADIUS, PKI and Certificate Infrastructure

CWSR · Work through your exam, one topic at a time.

All guide sections

RADIUS, PKI and Certificate Infrastructure

This domain tests the two back-end systems that make WPA2 and WPA3 Enterprise work: the RADIUS server that decides authorization, and the certificate infrastructure that binds identities. Questions are typically troubleshooting scenarios, asking you to identify which link in the chain is broken.

RADIUS behavior worth memorizing

RADIUS authentication uses UDP 1812 and accounting uses UDP 1813, with 1645 and 1646 as legacy ports. Each NAS shares a secret with the server. The Message-Authenticator attribute is required for EAP exchanges, EAP-Message carries and fragments the EAP payload, and State correlates challenge rounds. Authorization results are delivered through attributes: Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID for dynamic VLAN assignment; Filter-Id for ACLs; Session-Timeout for reauthentication. RFC 5176 change-of-authorization and disconnect messages let the server terminate or re-key a live session. Hardening means strong per-device secrets, NAS source-IP restrictions, logging, and RadSec over TLS on TCP 2083 wherever RADIUS traffic crosses an untrusted network.

PKI requirements for EAP

Certificates are X.509v3. A root CA should be kept offline with an issuing intermediate online. Validation checks the chain to a trusted anchor, the identity in the Subject Alternative Name, the extended key usage, validity dates, and revocation status through CRL or OCSP. The server certificate must carry a SAN matching the FQDN clients are configured to trust; Common Name matching alone is insufficient for modern supplicants. Client certificates need clientAuth usage and an identity the RADIUS policy can map to an account. Enrollment runs through SCEP, EST, or an MDM, and private keys should be generated on and protected by hardware such as a TPM or secure enclave.

Worked example

Users on one floor receive a certificate validation error while other floors work. The capture shows the AP presenting a certificate with CN=radius.corp.example but no Subject Alternative Name, and the client is pinned to the SAN. Reissue from the template with SAN=DNS:radius.corp.example, redeploy, and also confirm that the CRL distribution point is reachable from the client VLAN, because a blocked revocation URL produces the same visible failure even after the certificate is correct.

Traps that cost marks

  • Believing RADIUS encrypts the entire EAP conversation; only specific attributes such as User-Password are hidden.
  • Reusing one shared secret across every NAS.
  • Accepting a self-signed server certificate because clients were configured to skip validation; this is the root cause of most enterprise evil twin compromises.
  • Forgetting revocation checking, which turns a stolen laptop into a permanent credential.