Ruckus, FreeRadius, 802.1x & certificates that work on Windows devices

Question

We're using Freeradius as our AAA for our 802.1x authentication and currently have a self-signed certificate that works fine on iOS/Android/Chromebook/Linux/MacOS devices, and works for a short time on Windows devices. To resolve the Windows device issue we need to change up to a real certificate - the catch is we need one from a root CA that pre-exists in Windows so that the devices can validate it without needing to connect to the internet. Has anyone out there had this combination of technologies working, and which CA did you choose to get the certificate from that works?

unknown · Answer

Yes, at this point their root CA cert seems to be present in all keystores. They are definitely becoming the biggest gorilla in the business.

unknown · Answer

Unfortunately they're BYOD student owned devices and we don't want them domain joined or even MDM'd in any way, but Digicert sounds promising, thankyou. Have you had definite success with that CA?

unknown · Answer

Digicert would work...But you can install the cert on the windows machines... if you own them, as part of your domain....