topic Re: CloudPath - manually generate & deploy device certificate in Cloudpath Enrollment System (ES)

CloudPath - manually generate & deploy device certificate

bicky_budha — Mon, 15 Jun 2020 10:15:19 GMT

Hi,
Not sure if this is possible.
We have Ruckus vSZ with Cloudpath for on-boarding wireless devices. At the moment all BYOD users goes through the Cloudpath onboarding url >> enter their AD domain credentials which launches the NetworkWizardLoader-xxxx.exe and connects the user to the relevant SSID.

We have few non-domain/Intune managed devices shared by multiple users and would like to connect them to the wireless using the device based certificate. Is there a way on Cloudpath to generate\export the certificate manually which I can install it on the devices so that it connects automatically to the wireless ?

Or please advise of there is a better solution.

Any help on this would be much appreciated, thank you.

Re: CloudPath - manually generate & deploy device certificate

alex_sharaz — Mon, 15 Jun 2020 10:20:41 GMT

Yup if you log in as admin you can generate a cert from a certificate template and then download whatever format of file you need

Re: CloudPath - manually generate & deploy device certificate

liliia_reshytni — Mon, 15 Jun 2020 11:06:27 GMT

Yes you can install the cert and bind it to the device (user) certificate, Bicky.
BUT I do not think that you can export the certificate, generated by CP. You can create an account (onboard user) in internal Cloudpath database. Use credentials from Authentication Servers and device is good to go for auto connection inn future.

Re: CloudPath - manually generate & deploy device certificate

brett_nelson_78 — Mon, 15 Jun 2020 11:46:11 GMT

Liliia, the post from Alex above is correct.

Re: CloudPath - manually generate & deploy device certificate

liliia_reshytni — Mon, 15 Jun 2020 11:54:00 GMT

Thanks for follow up Brett! Nice to know you are with us. I learnt something new today:)

Re: CloudPath - manually generate & deploy device certificate

bicky_budha — Mon, 15 Jun 2020 15:04:41 GMT

thank you, Is there a help guide or knowledge-base article somewhere I can follow ?

Re: CloudPath - manually generate & deploy device certificate

brett_nelson_78 — Mon, 15 Jun 2020 15:27:42 GMT

Here are a couple of screenshots to illustrate... If you need further assistance with this, please open a ticket with Ruckus Support.

Re: CloudPath - manually generate & deploy device certificate

bicky_budha — Mon, 15 Jun 2020 15:44:42 GMT

thank you Brett, If i generate a certificate based on the existing BYOD template we use here, use one of the AD account on Username field, can I apply the same certificate to multiple devices ?

Re: CloudPath - manually generate & deploy device certificate

alex_sharaz — Mon, 15 Jun 2020 15:48:55 GMT

Well, you'd use the same template but not the same cert you 'd generate a different cert for each entered username

Re: CloudPath - manually generate & deploy device certificate

brett_nelson_78 — Mon, 15 Jun 2020 16:08:31 GMT

You could apply the same cert to different devices, but you would then not be able to uniquely distinguish them. It is not required that you use an AD account user for the Username field. That just establishes the username as part of the certificate's common name. When challenging users in a workflow using an AD authentication server, that is merely authorizing the user to be issued a cert... and that is the extent of AD's role. Subsequent connections are authenticated with the cert, and not AD at all. (in EAP-TLS use case, anyway...)

Re: CloudPath - manually generate & deploy device certificate

alex_sharaz — Mon, 15 Jun 2020 16:16:27 GMT

Would never consider using the same client cert on multiple machines. If you revoke it or it expires ... everything dies ...thats a lot of pain as the number of people using the same cert increases

Re: CloudPath - manually generate & deploy device certificate

brett_nelson_78 — Mon, 15 Jun 2020 16:17:47 GMT

Agree 100%

Re: CloudPath - manually generate & deploy device certificate

alex_sharaz — Mon, 15 Jun 2020 16:38:17 GMT

And another no-no is assigning certs owned by a user to headless devices .. so that when you delete that user from cloudpath all the certs owned by them get are deleted ... and all your headless devices stop working ...

Re: CloudPath - manually generate & deploy device certificate

bicky_budha — Tue, 16 Jun 2020 07:56:08 GMT

thank yo Alex.
We have bulk laptops that are shared by multiple students, is there a solution for this ?
or the only way is to join them to the domain and push EATP-TLS/Certificate via GPO.

Re: CloudPath - manually generate & deploy device certificate

paliton_scott — Wed, 10 Mar 2021 14:14:53 GMT

Did anyone actually get this to work? I had a customer ask to be able to deploy a cert manually rather than through CP when using the internal CA and RADIUS. The issue I found was that although the cert installs and shows up in the users record, the device it does not authenticate because there isn't an enrollment record associated with the cert.