Chromebooks and Certificate based WiFi EAP-TLS

[mikeglover]

Wondering if anyone has been through setting up certificate based wifi rather than password based wifi on a large collection of Chromebooks.

Basically I have just over 600 chromebooks that all get setup on a SSID that is WPA2 password. Password is compromised and the leases for the subnet are being taken up by devices that aren't mine.

I'd like to look at something long term thats better and started looking at EAP-TLS with Radius rather than just setting up another password and ending up in the same boat again.

ChatGPT led me down a whole path which ended up in alot of frustration.

I manage all my chromebooks with Google Admin Console and have the fundamentals licence. Apparently there is no easy mechanism to deploy certificates to devices and Google leave you to make you own thing. I setup a NDES server but I don't even though if this is the right thing to do.

Appreciate anyone that has been gone this route and been successful and share any advice. 

[colly72]

We're using NPS Server with certificate based EAP-TLS (we're currently using Meraki).

 

Happy to try and help if you can give specifics.

[KK20]

this is what I did.  

 

I had a user that was "known" to the radius server.  this user has zero privs and is used purely to authenticate between google and radius.  Export the trusted CA that gave the radius server its certificate.  Then in google admin make sure you add the certificate exported above, then  I set up a  device WIFI profile that connected automatically, gave the WPA enterprise PEAP with the username and password known to the radius server, used the trusted CA cert.  This means that the device will authenticated to the radius server with the known user and give you WIFI before you log on.  Yoou can remove the old WPA2 personal wifi profile once you are happy.

 

If you need radius accounting with actual users (we dont care) you can create another user WIFI profile and I believe this will override the device profile once you have logged in.  Obviously chicken and egg means you still need a device profile for the pre-logon page.