802.1x RADIUS cert renewal. (clearpass with JamfPro)

[jules1987]

Hi everyone,

the first renewal of the radius cert is due in a month and I am not confident on how to do this without disconnecting all of our 250+ clients.

I believe I have perhaps made mistakes regarding best practices. However, I had no other choice since all certs and network payloads needed to be in one profile. The Jamf Profile used to deploy the 802.1x auth contains:

• the RADIUS cert
• the CA cert
• the info about which cert template to use to issue a cert for any given machine
• the wired and wireless network configuration settings with the certificates used to connect.

All certs are issued via the ADCS server to be able to renew automatically since MacOS and IOS would not be able to do this if done without it.

As far as I understood it, it had to be done this way, (all in one approach) to be able to select the cert to use for any given network connection that the conf-profile is controlling.

However, once I would re-redeploy this conf-profile, the clients would lose the connection before receiving the new config. Is it possible to deploy the renewed RADIUS certificate in a separate conf-profile? Then, however, I would not be able to select the cert in the WiFi and ethernet payload section... Any hints in the right direction are appreciated. If there is a better way to accomplish this.

with kind regards, Julian Niedzwetzki 

[sdagley · Accepted solution]

@jules1987 If you edit a previously deployed Configuration Profile and choose "Distribute to All" when saving it will simply update the profile on targeted devices, not do a remove then re-install.

[sdagley · Accepted solution]

@jules1987 If you edit a previously deployed Configuration Profile and choose "Distribute to All" when saving it will simply update the profile on targeted devices, not do a remove then re-install.

[jamiesmithJAX]

I put the new 802.1x cert into my existing profile ahead of when the networking team uploads the cert on their end and keep the existing cert in the profile as well.  Then when networking does their thing, the Macs will already have the new cert and they reconnect.  Just have to go back in a week or so and remove the expired cert from your profile

[jules1987]

Thank all of you. Until now, I was under the impression that edited profiles would be remove-redeployed so I was thinking too complicated. I have been using JamfPro for over 8 years but somehow, I never understood this properly.

[agungsujiwo · Accepted solution]

Three months ago, we updated our RADIUS certificate. During this process, we chose not to push the RADIUS certificate through Jamf because our WPA Enterprise setup uses Active Directory account credentials (rather than static accounts) for authentication.

With this setup, each user logs into Wi-Fi individually. After the RADIUS certificate change, Mac users encountered a pop-up upon connecting to Wi-Fi,

prompting them to continue and enter their MacBook login password to reconnect to the internet. However, users connecting via LAN cable were unaffected and did not see any pop-up.
then after that you can schedule to delete the expired cppm cert manually in Keychain Access.

Note:
We inform via email what to do after changing the cert, so that users know the steps to take.
300+ User Mac
300+ User iPad

[jules1987]

Thank you for your input. Yes, I have to do this as well, as most of our users are Gr.6 to Gr 12 students, and they are BYOD. So we have no control over them whatsoever. We will send an email to all of them, and the teachers. I figure a fair number of them will read and forget or not read the mail. But that's part of the business.

[ferriterj1]

Sorry to reopen this, but did this end up working out for you? I'm currently running into the same issue where I'm going to need to update my Cisco ISE radius certs that are in my device WiFi configuration profiles for Macs and iPads and am looking for the best way to do so. 

@jules1987 did you end up just updating the profile and then deploying it back out to everyone to update it?

[jules1987]

Hey, @ferriterj1  

yes it worked by just updating for me. I just added the new cert to the existing mobile device conf profile, and deployed it to all (rather than to newly assigned only) It effectively updated the profile with the new setting.

[ferriterj1]

Thank you so much! It's not every day that you find someone to have the same issue and then an easy solution to it. This takes a load of my mind haha!