Administrator Guide

3. The server verifies the employee‘s credentials, and the employee is connected to the network.
Using Both Client and Server Certificates
There is a potential problem in this authentication sequence—the employee verified the server’s identity, but
the server didn’t verify the employee's identity. It is possible that the user stole the username and password
from another employee and is using these stolen credentials on his own device.
This problem can be solved by using both a client certificate and a server certificate. Because EAP-TLS
authentication employs both server and client certificates, when the employee begins authentication, the W-
ClearPass server sends the server certificate to the employee‘s laptop. The employee's laptop then sends the
client certificate to the server.
Both the client and the server can then verify the identity of the other party and are ready to proceed: The
employee sends the encrypted username and password to the server, the server verifies the employee's
credentials, and the employee is connected to the network. This access process is secure.
How to Obtain a Signed Certificate from Active Directory
The tasks to obtain a signed certificate from Active Directory are as follows:
1. Create a Certificate Signing Request.
2. Import the root Certificate Authority file to the Certificate Trust List.
3. Obtain a signed certificate from Active Directory.
4. Import a server certificate into the W-ClearPass Policy Manager server.
These tasks are described in the following sections.
Creating a Certificate Signing Request
This task creates a Certificate Signing Request to be signed by a Certificate Authority (CA).
Figure 97 shows an example of the Create Certificate Signing Request page, followed by descriptions of each
parameter (see Table 17).
To create a Certificate Signing Request:
1. In W-ClearPass, navigate to Administration > Certificates > Server Certificates.
2. Select the Create Certificate Signing Request link.
Dell Networking W-ClearPass Deployment Guide Preparing for Active Directory Authentication | 109