AD authentication require certificate - apple device not works

[Andrea]

Hi guys,

I have a little problem with AD authentication.
I have a controller and some APs, i have two SSID, one for employees, and one for guests.

I have configured my controller in way that for the employee access, it require an AD user.

To do this,i have configured a IAS Server that is a radius server that contacts my Active directory.

But this not works properly , for some reason, when i connect to employee SSID, the controller requires a CERTIFICATE.

If i click "continue" it works.. but i don't want that it requires something other by AD user.

another issue is that if i try to link an apple device it not works.

can you help me please?
thanks in advance
Best regards

[cappalli]

That is a normal part of the PEAP process. The server is saying "Hey, do you trust me to take your credentials?"

The only way around this would be to either manually configure the clients to trust the CA, or use a tool like ClearPass QuickConnect to configure the trust settings automagically.

[SethFiermonti]

The issue is that the Apple devices don't trust the server certificate.  Check your AAA profile.  Is EAP Termination enabled/checked off? If so, then you are using the controller certificate.  If not, then you are using the certificate on IAS.  

Either way, you need to have that cert signed by a trusted public CA - Verisign, Entrust, GoDaddy, etc... 

That is the only way to bypass the continue button on Apple.  However, keep in mind that this will only happen once.  Once you trust as the user, you shouldn't have to hit that step again.

[Andrea]

Hi,
Like you can view in image that i have attached.
the certificate is presented by a trusted public CA GeoTrust Global CA.

so, even if the certificate is pubblic, i have this issue.

any idea?