Troubleshoot certificate-based 802.1X authentication by separating client, RADIUS, PKI, and network causes.
Before you start
Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.
Step by step
- Check that the client has a valid certificate with the correct EKU.
- Verify client trust in the RADIUS server certificate.
- Confirm time, PKI chain, and revocation status.
- Read RADIUS logs to identify the exact rejection stage.
- Compare a successful authentication with the failing one.
Validation
Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.