How to test EAP-TLS authentication

⌚ About 2 min read

Troubleshoot certificate-based 802.1X authentication by separating client, RADIUS, PKI, and network causes.

Before you start

Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.

Step by step

Check that the client has a valid certificate with the correct EKU.
Verify client trust in the RADIUS server certificate.
Confirm time, PKI chain, and revocation status.
Read RADIUS logs to identify the exact rejection stage.
Compare a successful authentication with the failing one.

Validation

Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.

Technical deep dive

802.1X / WPA3 / RADIUS: identify the exact rejection stage

Technical checkpoints

In 802.1X, the supplicant, authenticator (AP/switch) and RADIUS server have distinct roles; RADIUS logs often identify the exact stage.
EAP-TLS validates the client certificate and trust in the server certificate; time, chain, EKU and revocation are critical.
WPA3

EAP chain

Compare a working client and a failing client, including certificates, then read the matching RADIUS log.

certutil -store -user My
# on RADIUS: record EAP type, reject reason and NAS

Topic-specific pitfalls

Disabling server certificate validation to “make EAP-TLS work” removes an essential protection.
A wrong RADIUS shared secret can look like a complete absence of valid requests on the server.

How to validate

The client validates the server certificate and RADIUS accepts the expected identity/certificate.
Post-authentication VLAN/policy assignment matches the expected profile.