Bank laptops present machine certificates for EAP-TLS. The RADIUS server log says it does not trust the authority that issued those certificates. What is missing on the server?
Select an answer to reveal the explanation.
Short Explanation
The laptops are showing their certificates, and the server does not know the authority that signed them. Your fix is to make the server trust that authority. A passphrase is a different login, not a repaired trust.
Full Explanation
EAP-TLS fails if the RADIUS server cannot chain the client certificate to a trusted authority. The log says the server does not trust the issuer of the laptop certificates, so the missing piece is that trust on the server, either the issuing authority or an intermediate it needs. The laptops are already presenting certificates. A shared passphrase would abandon EAP-TLS. It does not make an untrusted certificate chain valid, and the bank is using certificates on purpose. An 802.11v BSS transition request is a roam suggestion. It does not mark a certificate authority trusted, and this failure is on the first authentication, not on a roam. The beacon interval does not renew certificates. Certificate lifetime is a PKI fact, and a faster beacon will not insert a trusted authority into the server. Exam caveat: trusting the root is not enough if an intermediate is missing. The chain the laptop sends has to build to the trust anchor the server holds. Operational check: on the RADIUS server, view the rejected certificate, note the issuer, and confirm that issuer is trusted, then retry one laptop.