Security

Hi,

We have used the CP onboard CA as internal CA. and created a CP Radius Server Certificate by generating new CSR and upload csr to onboard CA and signed, downloaded the cert and imported to CP server.

but after creating the trusted certificate using onboard CA, during the certificate export there are options to export in .crt, pem formats. which format we need to use to export? tried to export using .pem with include intermediate CA.  is that correct or need to export both Root and Intermediate CA's?

Any advice or recommendations would be greatly appreciated. 

You should not use the ClearPass CA for this. Deploy an enterprise CA instead. Are you actually using OnBoard? If so why? What's the use-case for allowing unsecure/unknown/unmanaged endpoints onto the protected network? Why not use an MDM? How will you deal with certificate trust?

Hi,

We have used the CP onboard CA as internal CA. and created a CP Radius Server Certificate by generating new CSR and upload csr to onboard CA and signed, downloaded the cert and imported to CP server.

but after creating the trusted certificate using onboard CA, during the certificate export there are options to export in .crt, pem formats. which format we need to use to export? tried to export using .pem with include intermediate CA.  is that correct or need to export both Root and Intermediate CA's?

Any advice or recommendations would be greatly appreciated. 

Hi,

HPE Experts recommended that, we can use Onboard CA as internal CA. created new certificate authority and exported the root and intermediate cert, push these 2 certs via Intune Policies to the windows/macbook devices.  and create a new CSR and submitted to Onboard CA authority to sign/issue. Then downloaded cert and imported to ClearPass as Radius Server Certificate. it was working fine for few months till we generate new radius server certificate to troubleshoot Macbook Wi-Fi issues. 

When we use onboard CA as internal CA , the certificate trust will be automatically added to the certificate store and enbled for EAP,RadSec,Others

You should not use the ClearPass CA for this. Deploy an enterprise CA instead. Are you actually using OnBoard? If so why? What's the use-case for allowing unsecure/unknown/unmanaged endpoints onto the protected network? Why not use an MDM? How will you deal with certificate trust?

Hi,

We have used the CP onboard CA as internal CA. and created a CP Radius Server Certificate by generating new CSR and upload csr to onboard CA and signed, downloaded the cert and imported to CP server.

but after creating the trusted certificate using onboard CA, during the certificate export there are options to export in .crt, pem formats. which format we need to use to export? tried to export using .pem with include intermediate CA.  is that correct or need to export both Root and Intermediate CA's?

Any advice or recommendations would be greatly appreciated. 

Hi,

HPE Experts recommended that, we can use Onboard CA as internal CA. created new certificate authority and exported the root and intermediate cert, push these 2 certs via Intune Policies to the windows/macbook devices.  and create a new CSR and submitted to Onboard CA authority to sign/issue. Then downloaded cert and imported to ClearPass as Radius Server Certificate. it was working fine for few months till we generate new radius server certificate to troubleshoot Macbook Wi-Fi issues. 

When we use onboard CA as internal CA , the certificate trust will be automatically added to the certificate store and enbled for EAP,RadSec,Others

You should not use the ClearPass CA for this. Deploy an enterprise CA instead. Are you actually using OnBoard? If so why? What's the use-case for allowing unsecure/unknown/unmanaged endpoints onto the protected network? Why not use an MDM? How will you deal with certificate trust?

Hi,

We have used the CP onboard CA as internal CA. and created a CP Radius Server Certificate by generating new CSR and upload csr to onboard CA and signed, downloaded the cert and imported to CP server.

but after creating the trusted certificate using onboard CA, during the certificate export there are options to export in .crt, pem formats. which format we need to use to export? tried to export using .pem with include intermediate CA.  is that correct or need to export both Root and Intermediate CA's?

Any advice or recommendations would be greatly appreciated. 

You don't provide all the information, like what is the authentication method, and how do you provision your clients.

The setup and operations of a CA comes quite exact, and if you don't do the things exact right, you will get all kinds of unpredictable behavior. If you fully understand what you need to do, it should just work. Renewing/replacing the RADIUS server certificate can be challenging and should be carefully planned and tested.

With the information that you provided, it's not possible to tell why you see what you see. If things suddenly break there is a reason for that, but it's much easier for someone with access to the configuration, design, workflows, devices to find the root cause.

Hi,

HPE Experts recommended that, we can use Onboard CA as internal CA. created new certificate authority and exported the root and intermediate cert, push these 2 certs via Intune Policies to the windows/macbook devices.  and create a new CSR and submitted to Onboard CA authority to sign/issue. Then downloaded cert and imported to ClearPass as Radius Server Certificate. it was working fine for few months till we generate new radius server certificate to troubleshoot Macbook Wi-Fi issues. 

When we use onboard CA as internal CA , the certificate trust will be automatically added to the certificate store and enbled for EAP,RadSec,Others

You should not use the ClearPass CA for this. Deploy an enterprise CA instead. Are you actually using OnBoard? If so why? What's the use-case for allowing unsecure/unknown/unmanaged endpoints onto the protected network? Why not use an MDM? How will you deal with certificate trust?

Hi,

We have used the CP onboard CA as internal CA. and created a CP Radius Server Certificate by generating new CSR and upload csr to onboard CA and signed, downloaded the cert and imported to CP server.

but after creating the trusted certificate using onboard CA, during the certificate export there are options to export in .crt, pem formats. which format we need to use to export? tried to export using .pem with include intermediate CA.  is that correct or need to export both Root and Intermediate CA's?

Any advice or recommendations would be greatly appreciated.