I'm looking at a scenario of having a standalone offline root CA sign a subordinate CA in two separate active directory forests on different campuses.

If I then set up EAP-TLS on each site, will I be able to authenticate with EAP-TLS on either campus if the client has a computer certificate from either subordinate CA?

Assume the client trusts the root CA.

  • $\begingroup$ After a short reading it seems like EAP-TLS is essentially standard TLS (though quite often with client-certs). This means that if you configure your endpoints who do the server-side negotiation to request / accept anything issued under the common root (as opposed to only accepting client certs issued under their local intermediate CA), then the other forest's certificates will be accepted. $\endgroup$ – SEJPM Sep 10 '18 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.