Creating a certificate for 802.1x wireless access....

Question

I know this is a complicated issue.  We are trying to setup 802.1x access to our corporate WiFi using computer identity with certificates.
The video provided by apple here: http://www.apple.com/education/resources/information-technology.html#authenticat ion_on_mac at the 3:04 mark the instructors talk about importing a computer identity certificate into the key chain but doesn't mention how it's generted in the first place.
This is where we are stuck.
When we think about generating the proper certificate and click on Configure under Authenticition with TLS checked we get the following:
No Certificates Found...
We are using a Microsoft Windows Server 2008 Certificate Authority server as our in house certificate server.
Any help would be greatly appreciated.  Thanks in advance!
-Paul

Answer 1

step 1a create Wirelesscert.mobleconfig with the following changing the defaults to match your needs
The "Certtemplate key" must match the name of the Cert template on the server.
You can use the same machine cert template as the PCs. use UUID are done in the next step
CertServer Key use http or https depending on you cert server config
Generic config file sortof :
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <dict>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>CertServer</key>
                <string>https://Server.domain.name/certsrv</string> 
                <key>CertTemplate</key>
                <string>Your_Computer_template_name</string>
                <key>PayloadDisplayName</key>
                <string>Enter_your_name_fort_the_policy</string>
                <key>PayloadIdentifier</key>
                <string>Create_payload_ident</string>
                <key>PayloadType</key>
                <string>com.apple.ADCertificate.managed</string>
                <key>PayloadUUID</key>
                <string>Change-me-to-a-new-UUID</string>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>deleted</key>
                <false/>
            </dict>
        </array>
        <key>PayloadDescription</key>
        <string>Enter_Description_here</string>
        <key>PayloadDisplayName</key>
        <string>Enter_Display_name</string>
        <key>PayloadIdentifier</key>
        <string>Enter_paylode_name</string>
        <key>PayloadOrganization</key>
        <string>Enter_paylode_orgname</string>
        <key>PayloadRemovalDisallowed</key>
        <false/>
        <key>PayloadType</key>
        <string>SystemConfiguration</string>
        <key>PayloadUUID</key>
        <string>Change-me-to-a-new-UUID</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
    </dict>
    </plist>
Step 1b. Create two UUID on the mac command shell past into the file replace Change-me-to-a-new-UUID with two different UUIDs
the command is "uuidgen" You must run uuidgen once for each number. Paste the resulting numbers into Wirelesscert.mobleconfig
This must be done for every computer you install the policy on so that they are Unique to that computer.
Do these steps in a local machine admin account  not logged into the domain
step 2. In Lion 7.2 (only) Turn off the Cert checking to prevent a endless loop  (a known bug should be fixed in a update)
   a. open Key Chain Access
   b. Click on Keychain Acess in the apple tool bar
   c. Select Preferences
   d. Select the Certificates Tab
   f. Turn off OCSP and CRL   ( this can be turned back on after you get the Cert from ad)
Step 3 Connect using safari to you Microsoft AD certificate server and trust the locally self signed Cert
Step 4 copy Cert in key chain from user to system
Step 5 open a shell for steps 6 and 7
Step 6 type Sudo kinit -k (machinenamelowercase)$    ! the dollarsign is appended to the computer name
Step 7 type klist -l   ! verify that a ticket in kerberos is listed under the machine name
Step 8  double click on the file Wirelesscert.mobleconfig to import the profile and create the Certificate
Step 9  Verify in the Key Chain that you have a system Certificate
In the network wireless click on the Join the ssid  
Mode is EAP-TLS
Identity X509 Certificate  (the one just created)
Username: host/(Your_Macs_Fully_qualified_name)
I hope this helps now I now have a Cert from ad on the machine and I think when it expires the plugin will renew.
Read the Original document this is based on at http://support.apple.com/kb/HT4784
I just need to figure out how to set a policy that uses the Cert on the machine
Message was edited by: daveBoxElderSD