Can You Safely Configure Digital Certificates On FreeRADIUS?
What is RADIUS?
Remote Authentication Dial-In User Service (aka RADIUS) is a protocol used to authenticate users and devices on a network. One of our favorite comparisons is to say that RADIUS servers are like bouncers at the door; they check the credentials of each person attempting to access your Wi-Fi or VPN and allow or deny them accordingly.
There are numerous ways to add RADIUS to your own network security – some are even free, such as the aptly named FreeRADIUS. Although using a RADIUS server heightens your security, it’s even better when you use it in tandem with digital certificates instead of passwords. Many of our customers improved their own network security using Cloud RADIUS with certificates. But can no-cost solutions like FreeRADIUS authenticate certificates?
What is FreeRADIUS?
The answer to this question is essentially in the name: FreeRADIUS is an open-source RADIUS server and an assortment of supporting utilities related to the operation thereof. It’s easily the most popular RADIUS online. In fact, it’s estimated that FreeRADIUS authenticates over a third of the entire internet.
It’s popular with good reason. For many, it’s an excellent starting point when it comes to updating your network security through use of the RADIUS protocol on a budget. However, like most free things, it will take quite a bit of work.
Configuring FreeRADIUS for use with your operating system requires time and expertise. It’s not plug-and-play, like our Cloud RADIUS, which seamlessly integrates with all major cloud Identity Providers (IDPs) such as Azure, Okta, and Google.
Does a RADIUS Server Need a Certificate?
The issues with using passwords are legion. Aside from being cumbersome for the end-user (think about all those annoying password resets and requirements), they’re a gaping security vulnerability.
Certificate-based authentication (CBA) is a much more secure alternative. Certificates, unlike passwords, can’t be stolen, and you don’t need to remember to use them.
RADIUS servers are commonly used alongside CBA. Rather than checking a username and password, the RADIUS simply checks that each certificate authenticating to your network is valid. Your RADIUS server itself can even be equipped with its own certificate called a server certificate. This means that devices will verify it’s the correct server to connect with before they send their own certificates over for authentication in a process called server certificate validation.
Truthfully, you don’t absolutely need certificates to use RADIUS. It’s a significantly better practice, though, and it doesn’t hurt that certificates make for an all-around improved user experience.
Does FreeRADIUS Support Certificates?
Like most other RADIUS servers, a FreeRADIUS server is capable of authenticating certificates. The issue is that it wasn’t specifically built for use with certificates. That’s not to say that you shouldn’t use it that way, but it will take some additional configuration on your part.
You can find a more detailed guide for configuring EAP-TLS, the authentication protocol most commonly used with certificates, on FreeRADIUS here. The general process, however, is as follows:
- Installing FreeRADIUS.
- Creating test certificate templates.
- Configuring 802.1X on your SSID.
- Testing the certificates in the server.
As simple as it may sound, there are a lot of errors that can occur during this process. Furthermore, FreeRADIUS configuration itself takes both time and experience.
Thankfully, there are much simpler solutions created specifically for CBA, such as our Cloud RADIUS. Cloud RADIUS was created from the ground up to be used with certificates, and therefore doesn’t require any additional configuration for CBA.
But the benefits don’t stop there. Because (as the name implies) it’s hosted in the cloud, Cloud RADIUS can be used from anywhere. You can ditch those costly on-prem RADIUS servers and authenticate wholly from the cloud, which is ideal for businesses with multiple offices.
On top of that, Cloud RADIUS was created with vendor-neutrality in mind. You don’t need to worry about whether it will play nice with your existing environment, regardless of your IDP, MDM, or operating systems. It’s the definition of plug-and-play.
Secure, Simple Certificate-Based Authentication with Cloud RADIUS
Certificate-based authentication is definitely possible with FreeRADIUS. Some may even find it easy, but many more may struggle to configure it properly…and a misconfigured RADIUS is a liability for your network.
On the other hand, Cloud RADIUS is a secure, simple, and economical alternative – both in terms of time and money. Our knowledgeable support team has years of experience implementing our Cloud RADIUS alongside certificates for organizations of all sizes and verticals.
Don’t let the “free” in FreeRADIUS be your only consideration. SecureW2 has plenty of affordable bundles. Check out our pricing today to learn more.
