Certificate on acs

Question

Hello Folks
wifi users are authenticated via single sign on on ms AD  using acs(802.1X)
question is. is it mandatory to generates a certificate in the acs than export it to the contoller in order to let the authentication works

Answer 1

Hi Ibrahim,
How are you?
First, what 802.1X EAP are you using?What ACS rev are you on?
I will assume PEAP.
1) ACS Cert is requried. You have 2 options for a certifciate.
     a. You can do a self generated certifciate which is  created on and by the ACS server. This cert last 12 months from the time  you create      it. Here is further reading on the ACS self cert.
     Personally, Im not a fan of the self signed ACS  certiciate. Becuase if you vaildate the cert on the client you will need  to push this cert to      each client. I will explain that later.
Self-signed Certificate Setup (only if you do not use an external CA)
Note: When you test in the lab with self-signed certificates,  it results in a longer authentication time the first time a client  authenticates with the Microsoft supplicant. All subsequent  authentications are fine.
Complete these steps:
On the Cisco Secure ACS server, click System Configuration.
Click ACS Certificate Setup.
Click Generate Self-signed Certificate.
Type something into the Certificate subject field preceded by cn=, for example, cn=ACS33.
Type the full path and name of the certificate that you want to create, for example, c:\acscert \acs33.cer.
Type the full path and name of the private key file that you want to create, for example, c:\acscert \acs33.pvk.
Enter and confirm the private key password.
Choose 1024 from the key length drop-down menu.
Note: While Cisco Secure ACS can generate key sizes greater  than 1024, the use of a key larger than 1024 does not work with PEAP.  Authentication might appear to pass in ACS, but the client hangs while  authentication is attempted.
Check Install generated certificate.
Click Submit.
     b. You can get a CA signed certifciate. If you are  using 4.x ACS you can generate what is called a CSR. Certifciate Signing  Request. You           then send the CSR to a CA and they generate a cert for you.
Here is a link to read up on the CA certifciate.
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a0080545a29.shtml#t14
How and where to install the certs and how it works...
1) The cert is installed on the ACS server and the  client IF a) you are vaildating the cert on the client b) you are using  an acs self signed cert
So the ACS server has a cert  installed on it. This cert is used to building a secure tunnel between  the ACS server and the wireless client so that when the wireless client  passes its credentials they can not be seen as they are passed in the  tunnel created by the cerifciate (think HTTPS).
When a  wireless client connects. The WLC / WLAN is configured with 802.1X. So  the WLC passes all the authentication traffic directly to the ACS. So  the WLC DOESNT NEED TO KNOW ABOUT THE CERT. This chatter is just between  the ACS and the wireless client and the WLC acts as the middle man.
So  the wireless client connects. The ACS server sends the cert (the one  you added) to the wireless client. The wireless client has 2  configurable options. 1) Vaildate the certifciate 2) Not Vaildate the  certifciate. If you Vaildate the certifciate then that cert needs to be  on the client, becuase the client is going to look at the cert presented  by the acs server and see if it has it in its root store, thus  vaildating it. Or you can not vaildate it. If you dont vaildate it, it a  BIG security boo boo.
Make sense?