802.1X Certificate auth for non-domain devices

[gshaw]

I'm currently testing a new Wi-Fi system to replace our existing Aruba setup and one of the things I'm trying is 802.1X certificate auth for our internal network devices (domain laptops and so on)

 

It works fine in NPS with our Windows CA, with GPO to auto-enroll the certificate and push the SSID profile. Easy for Windows 10 laptops but wondering what people do with...

 

• macOS laptops
  
• iPads
  
• Android tablets
  

Seems like I can go and manually request certificates provided the device's hostname \ FQDN matches perfectly but that seems rather onerous for a large number of devices. Is there anything slicker or do you end up with a separate SSID \ auth method for these?

 

Edit: found a few useful-looking links, anyone using SCEP \ NDES to generate the certificates for Apple devices?

 

or maybe this?

 

https://support.apple.com/en-my/HT204602

Edited April 25, 2019 by gshaw