Security

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

One slight security reason to use a private CA is that if you use a public CA and your clients are configured to trust that CA, but aren't limited to a set of trusted hostnames for your RADIUS servers, then an attacker could get a valid certificate signed by that CA and then spoof your SSID and capture credentials from clients (if using MSCHAPv2) and generally intercept traffic. Whereas with a private CA you can be sure (unless someone steals your root CA's key) that attackers can't issue their own certificates under it. This is a fairly specific misconfiguration though.

One reason to use a public CA is if you need to support Android BYOD, as getting a private CA cert on there is a real pain without an onboarding tool (and ClearPass OnBoard is very expensive). Eduroam users can use geteduroam to help, but others would have to develop their own solution.

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

We used to use a public CA certificate with users just trusting the certificate CA chain so we could update the RADIUS server certificate without needing to re-onboard users.

A few years ago, within 1 day of a scheduled certificate replacement, I found out our vendor had changed their certificate chain. We narrowly averted a network outage. Since our onboarding vendor SecureW2 has a clous PPKI we were planning on using for EAP-TLS, we set up private CAs and a 15 year RADIUS certificate. We encourage our users to re-onboard to get the added new trust before deploying.

Using a private CA chain closes the hole of somebody getting a certificate from the same CA chain and our users trusting that. We also do not need to worry about RADIUS server certificate expiry.

Since we were already paying for the PKI, there was no additional expense for us.

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

We used to use a public CA certificate with users just trusting the certificate CA chain so we could update the RADIUS server certificate without needing to re-onboard users.

A few years ago, within 1 day of a scheduled certificate replacement, I found out our vendor had changed their certificate chain. We narrowly averted a network outage. Since our onboarding vendor SecureW2 has a clous PPKI we were planning on using for EAP-TLS, we set up private CAs and a 15 year RADIUS certificate. We encourage our users to re-onboard to get the added new trust before deploying.

Using a private CA chain closes the hole of somebody getting a certificate from the same CA chain and our users trusting that. We also do not need to worry about RADIUS server certificate expiry.

Since we were already paying for the PKI, there was no additional expense for us.

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

With our EAP-TLS SSID users cannot choose to trust the RADIUS certificate. Having them do that is an insecure practice that should be discouraged anyway.

We used to use a public CA certificate with users just trusting the certificate CA chain so we could update the RADIUS server certificate without needing to re-onboard users.

A few years ago, within 1 day of a scheduled certificate replacement, I found out our vendor had changed their certificate chain. We narrowly averted a network outage. Since our onboarding vendor SecureW2 has a clous PPKI we were planning on using for EAP-TLS, we set up private CAs and a 15 year RADIUS certificate. We encourage our users to re-onboard to get the added new trust before deploying.

Using a private CA chain closes the hole of somebody getting a certificate from the same CA chain and our users trusting that. We also do not need to worry about RADIUS server certificate expiry.

Since we were already paying for the PKI, there was no additional expense for us.

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?

We used to use a public CA certificate with users just trusting the certificate CA chain so we could update the RADIUS server certificate without needing to re-onboard users.

A few years ago, within 1 day of a scheduled certificate replacement, I found out our vendor had changed their certificate chain. We narrowly averted a network outage. Since our onboarding vendor SecureW2 has a clous PPKI we were planning on using for EAP-TLS, we set up private CAs and a 15 year RADIUS certificate. We encourage our users to re-onboard to get the added new trust before deploying.

Using a private CA chain closes the hole of somebody getting a certificate from the same CA chain and our users trusting that. We also do not need to worry about RADIUS server certificate expiry.

Since we were already paying for the PKI, there was no additional expense for us.

I regularly hear in Aruba circles that it is recommended to use a private certificate authority for ClearPass RADIUS, for example, in Herman's "Aruba ClearPass Workshop (2021) - Wireless Access #2 RADIUS - Basic part 2" (1:04), and then a public certificate authority for ClearPass Guest/Captive Portals, etc.

I've spoken with a few security professionals (who don't have any specific Aruba ClearPass experience) and they have all said that a public CA should be used on a RADIUS server and think it is unusual for Aruba to not recommend this. They have suggested maybe ClearPass has a particular reason/function/feature unique to ClearPass and maybe this is why it is recommended.

I've read through the "ClearPass Certificates 101" document but I couldn't see any justification for this, other than "Not for deep discussion at this juncture but discussed in a lot more depth later in my TechNote, we support the ability to privately sign a certificate (typically done for the RADIUS certificate)". Maybe I've missed the section where it is discussed in a lot more depth.

I've seen Herman post here the following reasons (this is my understanding of the post):

1. Server certs issued by a private CA can be valid for longer than 12 months, therefore, there is no need to replace the certificate each year. This obviously isn't relevant to the HTTPS cert.
2. A public CA might change or retire the root CA it is using, forcing a config update to clients. Using a private CA gives you the flexibility and control to change or retire a root CA if you wish to.

I don't see these as security reasons to use a private CA, they are management/maintenance reasons.

Is anyone aware of security reasons why ClearPass should be using a private CA for its RADIUS cert?