Specify Certificate for Wired 802.1x Authentication

Brent Hilgenkamp 10

I'm working on implementing 802.1x authentication on our wired/ethernet network using Cisco ISE and the native Windows (10) supplicant. I'll be using machine authentication with certificates. The issue I'm running into is that we have multiple Client Authentication certs all issued by the same CA installed on our machines and I can't find a way to tell Windows the exact cert I want to use for 802.1x. The most granular I can seem to get is to choose the Certificate Issues and certs that have the Client Authentication EKU but since that can match multiple certs on the machine it's not specific enough. Is there a way to have Windows choose based on Template Name or something, or what is the proper way to do that?

Ryan Fahey 0 Reputation points

2024-02-21T16:52:33.2+00:00

We were having the same problem, although we had 2 Certificates issued by different Root CAs and Issuing CAs. The below article describes how to build a WLAN profile with the added options of CA filtering. I don't think this solves your problem, unfortunately. But if you could issue one of the certs from a different CA then that would work.

https://learn.microsoft.com/en-us/windows/client-management/mdm/eap-configuration
JD_Mav 0 Reputation points

2024-03-25T21:02:56.6533333+00:00

What would be ideal is if you could specify which certificate based on the template that it was issued under, rather than EKU or CA. We're having the same issue, with migration from a pure AD environment to a pure Entra/Intune environment. The original certs were designed for authentication to AD as the computer, but the new computers don't exist in AD, so moving auth to Entra. The certificates are being issued by the same CA via NDES, but with a different template, and setting the cname based on the computers Entra ID information.

1 answer

Karlie Weng 18,281 Reputation points Microsoft Vendor

2024-01-31T06:54:06.39+00:00

Hello,

Certificate autoenrollment combine with group policy.

Reference below documents for more information:

Deploy Server Certificates for 802.1X Wired and Wireless Deployments: https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/deploy-server-certificates-for-802.1x-wired-and-wireless-deployments

Distribute Certificates to Client Computers by Using Group Policy: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/distribute-certificates-to-client-computers-by-using-group-policy

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.
Ryan Fahey 0 Reputation points

2024-02-02T21:08:32.5733333+00:00

I have this same problem, and I don't see how this answer is helpful.

These documents outline the process of certificate auto-enrollment (for a single cert), but have no mention anywhere of how to enforce a particular certificate from the machine perspective. We've already deployed certificate auto enrollment per these methods, and when we deployed a 2nd Certificate to the machines for pre-staging, some machines began immediately using the newest (invalid) certificate.

We concluded that windows 10 is choosing the most recently installed certificate, and we have yet to find the answer about how to influence this behavior. As best we can tell, the WLAN profile built during the process should have options for this, but it is apparently not documented very well.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Specify Certificate for Wired 802.1x Authentication

1 answer

Your answer