Skip to content

Server Certificates

EAP Server Certificates

802.1X is a protocol used for secure authentication and authorization in computer networks. When implementing 802.1X authentication, the NAS and the client device both need to authenticate each other using digital certificates.

The server certificate is usually issued by a trusted third-party Certificate Authority (CA) and is signed using the CA's private key. When a client device connects to the network and attempts to authenticate itself, it receives the server certificate from the authentication server and checks the certificate's signature to ensure that it was issued by a trusted CA. If the certificate is valid, the client device can then proceed with the authentication process.

On EAP-TLS, EAPTTLS and EAP-PEAP the server and the clients encrypt data using the TLS protocol. Our TLS server supports both ECDSA and RSA certificates, automatically matching the certificate with client’s supported cipher suite (ECDHE_ECDSA, ECDHE_RSA, or RSA).

For testing purposes, SpherAAA can be configured to use TLS with self-signed certificates and keys.

Creating the Server and CA Certificate using CertGen

SpherAAA provides tools for the generation of server certificates. To generate the certificate, navigate to Configuration > Secure > CA Certificates page.

During the certificate generation, you can specify to which EAP-Type and environment you would like to apply this server certificate.

CertGen column provides several functions:

  • Generate client certificate using this CA.
  • Generate Server certificate using this CA.

Action colum provides:

  • Manage the SCEP Server for CA certificate.
  • Download CA public certificate (PEM file)
  • Remove CA certificate (not recoverable!)

Secure page

CA Certificates list (click for enlarge)

Server Certificates Action column provides several functions:

  • Modify assigned environment and EAP-Types
  • Download full certificate (PEM file), including server private key.
  • Remove certificate (not recoverable!)

Secure page

Certificates list (click for enlarge)

Next click to CA/CertGen - Generate Server Certificate button

Generate server certificate

Certificate import

Fill in the certificate details and click to generate.

SCEP

SpherAAA supports SCEP (Simple Certificate Enrollment Protocol) for automated certificate enrollment. When SCEP is enabled for a CA certificate, SpherAAA generates a unique SCEP URL for that CA, over both HTTP and HTTPS. Devices and MDM platforms use this URL to request and enroll certificates automatically, without an administrator having to generate and distribute them manually.

To enable SCEP:

  1. Go to Certificates > CA/SCEP.

  2. In the CA certificate's Action column, select Manage SCEP.

  3. Set a Challenge password. Devices must submit this challenge password with their enrollment request; SpherAAA rejects any request with a missing or incorrect challenge password.

  4. Click Update SCEP Settings. A SCEP URL and the CA's fingerprint (SHA-512) are shown, ready to use in your SCEP client/MDM configuration.

Example SCEP URL:
https://cloud.spheralogic.com/scep/1234567/6830a8e7521115fcc5a91f96/

Use this URL and the challenge password in your SCEP client configuration to enroll certificates automatically.

Certificates issued through SCEP count toward the account's EAP-TLS client limit, the same limit that applies to certificates generated manually from the dashboard. If that limit is reached, further SCEP enrollment requests are rejected until the limit is raised or existing client certificates are removed.

Allowing enrollment without a challenge password

Some device management platforms have no way to supply a challenge password at all. The most common case is Microsoft Intune's built-in "SCEP certificate" device configuration profile: its settings page has no field for a challenge password, because Intune's design assumes an on-premises NDES server reachable through an Intune Certificate Connector, which SpherAAA does not implement. Devices enrolled through that profile type submit a certificate request with no challenge password at all.

To support this, a CA can be configured to accept SCEP enrollment without a challenge password:

  1. Go to Certificates > CA/SCEP and select Manage SCEP for the CA.

  2. Check Allow enrollment without a challenge password.

  3. Click Update SCEP Settings.

!!! warning "Not safe for untrusted networks" With this option enabled, any device that can reach the CA's SCEP URL can enroll a certificate. There is no secret to prove it should be allowed to. Only enable this for a trusted or local-network deployment, or when your device management platform genuinely has no way to supply a challenge password (such as Intune's built-in SCEP profile without an Intune Certificate Connector).

If you need to keep challenge-password protection while enrolling Intune-managed Windows devices, configure Intune with a Settings Catalog / custom OMA-URI profile targeting the ./Vendor/MSFT/ClientCertificateInstall/SCEP CSP directly instead of the built-in SCEP profile template. That CSP exposes a Challenge setting where you can enter the same challenge password configured on the CA in SpherAAA. This requires configuring each SCEP parameter (subject name, SAN, key usage, root certificate, etc.) individually rather than through Intune's guided SCEP profile UI.

Troubleshooting enrollment: SCEP Logs

Every SCEP request SpherAAA handles, capability checks, CA certificate requests, and enrollment attempts, is recorded to Certificates > CA/SCEP > SCEP Logs (also linked from Logs & Reports). Each entry shows the CA, operation, message type, result (success/failure), a specific failure reason when applicable, transaction ID, serial number, client IP, and user agent. Log entries are kept for 48 hours.

Common failure reasons shown in the Detail column:

  • bad_challenge_password: the device submitted a challenge password, but it didn't match the one configured for the CA.
  • empty_challenge_password: the device submitted no challenge password at all (or an empty one). This is expected from platforms like Intune's built-in SCEP profile, see Allowing enrollment without a challenge password above.
  • unsupported_message_type: the request used a SCEP operation SpherAAA doesn't support.
  • A message mentioning the account's EAP-TLS client limit: the certificate was not issued because the subscription's EAP-TLS client limit has been reached.

Import / Create the Server and CA Certificate manually

  1. Generate a private key for the CA:

openssl genrsa 2048 > ca-key.pem

  1. Generate the X509 certificate for the CA:
openssl req -new -x509 -nodes -days 3650 \
   -key ca-key.pem \
   -out ca-cert.pem

Creating the Server's Certificate and Keys

  1. Generate the private key and certificate request:
openssl req -newkey rsa:2048 -nodes -days 3650 \
   -keyout server-key.pem \
   -out server-req.pem
  1. Generate the X509 certificate for the server:
openssl x509 -req -days 3650 -set_serial 01 \
   -in server-req.pem \
   -out server-cert.pem \
   -CA ca-cert.pem \
   -CAkey ca-key.pem

Creating the Client's Certificate and Keys

  1. Generate the private key and certificate request:
openssl req -newkey rsa:2048 -nodes -days 3650 \
   -keyout client-key.pem \
   -out client-req.pem
  1. Generate the X509 certificate for the client:
openssl x509 -req -days 3650 -set_serial 01 \
   -in client-req.pem \
   -out client-cert.pem \
   -CA ca-cert.pem \
   -CAkey ca-key.pem

Upload certificate files to SpherAAA for EAP-TTLS/PEAP/TLS

  1. Go to Configuration > Secure

  2. Click to Import Certificate

  3. We will upload self signed certificates to SpherAAA as following:

    • Server Cert Private key: server-key.pem
    • Server Certificate: server-cert.pem
    • Root Certs: ca-cert.pem

Cert Import

Certificate import
  1. After successful import, you are ready to accept TLS/TTLS or PEAP with SpherAAA.

EAP-TLS Client Certificates

EAP-TLS Clients

Certificates list (click for enlarge)

To utilize EAP-TLS, follow these steps:

Create a client certificate on the CA Certificates (CertGen) page. CertGen offers several options. You can have the generated certificate sent to your email either as an attachment or through a one-time URL in formats like PEM, PKCS12, or Apple Mobileconfig file.

Generate EAP-TLS client certificate<

Generate EAP-TLS client certificate

The generated client certificate needs to be installed on the client device. For the iOS, through Apple Device Configuration (.mobilconfig file). For Android, via the WifiManager API.

You can download the generated client certificate in a few ways:

  1. PEM - the standard format used by most applications and systems.
  2. PKCS12 - for platforms that require this specific format.
  3. Email attachment - the certificate is sent to your email.
  4. One-time URL - a link that lets you download the certificate once.

wpa_supplicant example

Use the configuration below with wpa_supplicant to test EAP-TLS authentication against your Wi-Fi network.

network={
         ssid="YOUR_SSID_NAME"
         scan_ssid=1
         key_mgmt=WPA-EAP
       # pairwise=CCMP TKIP
       # group=CCMP TKIP
         eap=TLS
         identity="user@example.com"
         private_key="/etc/cert/pkey.pem" #First part of PEM file
       # private_key_passwd="password" #Passhprase for protected key
         ca_cert="/etc/cert/ca.pem" #Middle part of PEM file
         client_cert="/etc/cert/client.pem" #Last part of PEM file
     }

RADSEC

The original RADIUS protocol is insecure. RADSEC wraps RADIUS in a TLS tunnel. See RFC 6614 for details. The SpherAAA RADSEC client supports TLSv1.2 and TLSv1.3.

This page covers two things, split across tabs:

  • SpherAAA RADSEC Client Certificates: generating RADSEC client certificates for accessing SpherAAA over RADSEC (SpherAAA acting as a RADSEC server).
  • Third-Party AAA RADSEC Server Certificates: importing and managing certificates for third-party AAA servers, used during dynamic peer discovery for RADSEC servers via EAP realm in PolicyLogic, or when manually adding a NAS server using NAS Configuration.

Client Certificates

Generate a dedicated RADSEC client certificate for each RADSEC client (NAS, proxy, or RADIUS gateway) that connects to SpherAAA. How identification and authentication work:

  • The client certificate's identity can be used to recognize the client when the source IP address is not reliable.
  • The selected environment determines where requests are routed once the client is identified.
  • The secret authenticates the RADSEC client to the SpherAAA RADSEC server. The default value is radsec (per RFC 6614), but you can set a custom secret for better security.

To generate a certificate:

  1. Click Generate SpherAAA RADSEC Client Certificate.
  2. Set a Secret (or click Generate Password), choose the target Environment, set an expiration (Expires after days, default 1825), and add a Note.
  3. Click Generate. The full certificate, including the private key, is stored encrypted in the database.

After generation, download and securely store:

  • Client certificate (included in the PEM bundle)
  • Client private key (included in the PEM bundle)
  • SpherAAA Root CA

Protect the downloaded PEM bundle like a password: anyone holding it can authenticate as that RADSEC client.

Secure page

RADSEC Certificates list

The certificates table lists each entry's environment, secret, notes, serial number, creation and expiration dates, subject, and issuer. From the row's Actions menu you can:

  • Download the certificate (client certificate and private key)
  • Show the certificate content
  • Activate or revoke the certificate
  • Edit the environment, secret, or note inline
  • Delete the certificate (not recoverable)

Alternative CA Certificates

If your RADSEC client doesn't support client certificates, you can import your own CA certificate (public key) into SpherAAA, and it will be added to the list of trusted CAs. You can upload a single PEM file containing multiple certificates, or attach multiple files at once, along with a comment to identify them.

Secure page

Import RADSEC CA

MikroTik example

  1. Upload RADSEC certficate to MikroTik using Files menu:

Secure page

MikroTik file upload
  1. Import certificate using System > Certificate

Secure page

Imported certificate

  1. In the RADIUS settings, create a new RADIUS Endpoint configuration as showing below:

  2. Service: depends on service

  3. Address:
  4. Protocol: radsec
  5. Secret: Shared secret from the NAS
  6. Timeout: at least 2000ms
  7. Certificate: choose certificat from the list

Secure page

RADIUS Radsec configuration

Third-Party AAA RADSEC Server Certificates

Use this area when SpherAAA must connect securely to an external AAA platform over RADSEC. You upload the peer credentials and trust chain so SpherAAA can open and validate TLS sessions to remote RADIUS/AAA services.

This setup is common in roaming and federation scenarios (for example, OpenRoaming or eduroam), especially when peers are discovered dynamically through DNS or when connecting two AAA servers over the public Internet, without requiring IPsec or a VPN.

What to import

  • Client private key - proves SpherAAA identity to the remote server.
  • Client certificate - sent by SpherAAA during TLS negotiation.
  • Root CA / intermediate CA chain - verifies the certificate presented by the remote AAA server.

Tip: provide the full CA chain whenever possible to avoid "unknown issuer" errors during validation.

  1. Collect the required certificate files from the RADSEC server:
  2. Client private key
  3. Client certificate
  4. Server root CA / CA chain
  5. In SpherAAA, navigate to RADSEC > Third-Party AAA RADSEC Server Certificates, then select Import AAA Certificate. Upload the private key, client certificate, and CA chain, and add a note to identify the peer (for example, the peer's hostname).
  6. Keep CN/SAN verification enabled. Disable it only when required for a trusted peer that you control; disabling hostname verification reduces TLS protection.
  7. For dynamically discovered peers, reference the imported certificate set in PolicyLogic.
  8. For manually configured peers, assign the imported credentials in NAS Configuration when the NAS entry is set as a RADIUS server.
  9. If SNI is required, use a hostname (FQDN) as the destination instead of an IP address.

Treat the uploaded private key as a sensitive credential, and check that the certificate's expiration date and issuer chain are correct before saving.

Managing imported certificates

The certificates table lists each entry's ID, serial number, notes, creation and expiration dates, subject, and issuer. From the row's actions you can:

  • Download the certificate package
  • View certificate details
  • Revoke or re-enable a certificate
  • Remove a certificate entry (not recoverable)

EAP-AKA/SIM Identity

To decrypt the EAP-AKA/SIM Identity, the EAP-AKA/SIM private key must be imported. This key will be used to obtain the cleartext IMSI. The private key must be in PEM format.

Additionally, the public key must be included in the carrier-bundle. The serial number of the public key is also needed. EapAkaIdentity function resolves the corespinding private key using serial number.

  • Server Cert Private key: Private key in PEM format
  • Serial number: Public key serial number

To activate a private key in a specific environment, choose the corresponding switch.

Secure page

EAP-AKA/SIM configration

Back to top