IT Toolbox
Guide

How to check a 802.1X Wi-Fi configuration

A diagnosis 802.1X must follow the path supposing → point of access → RADIUS → identity/certificate.

TopicCybersecurity →
⌚ About 2 min read
View my favorites
& Wi-Fi Network. Advanced. 25 min.

A diagnosis 802.1X must follow the path supposing → point of access → RADIUS → identity/certificate.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Identify EAP.

    Note P far, EAP-TLS or something.

  2. 2

    Test RADIUS.

    Security and security.

  3. 3

    Read the AAA / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /

    The reason for rejection is essential.

  4. 4

    Check certificates.

    Chain, name and date.

À retenir

  • Avoid deactivating certificate validation as a durable solution.
  • Test with a well-known account and device.
← All les guides
Technical deep dive

802.1X / WPA3 / RADIUS: identify the exact rejection stage

Technical checkpoints

  • In 802.1X, the supplicant, authenticator (AP/switch) and RADIUS server have distinct roles; RADIUS logs often identify the exact stage.
  • EAP-TLS validates the client certificate and trust in the server certificate; time, chain, EKU and revocation are critical.
  • WPA3

EAP chain

Compare a working client and a failing client, including certificates, then read the matching RADIUS log.

certutil -store -user My
# on RADIUS: record EAP type, reject reason and NAS

Topic-specific pitfalls

  • Disabling server certificate validation to “make EAP-TLS work” removes an essential protection.
  • A wrong RADIUS shared secret can look like a complete absence of valid requests on the server.

How to validate

  • The client validates the server certificate and RADIUS accepts the expected identity/certificate.
  • Post-authentication VLAN/policy assignment matches the expected profile.
♡ 0