A municipality is rolling out EAP-TLS for thousands of city and school devices. Which CA and certificate-lifecycle consideration is most important at that scale?
Select an answer to reveal the explanation.
Short Explanation
EAP-TLS at city scale is a PKI problem wearing a Wi-Fi hat. Enrollment, renewal, and revocation have to work for real—not one golden cert on a USB stick. Self-signed portal art and intentional expiry earn tickets, not trust.
Full Explanation
Rolling out EAP-TLS for thousands of city and school devices makes CA and certificate-lifecycle operations the critical path: operate an enterprise PKI with managed enrollment, renewal, and revocation so device certificates remain trustworthy over years. At civic scale, lost devices, staff turnover, and school-year imaging cycles will break a DIY shared-certificate shortcut. Lifecycle is the security control, not only the EAP method checkbox.
Issuing one shared user certificate exported to every laptop simplifies help-desk resets while destroying accountability and revocation precision. Skipping a private CA and pasting self-signed certificates into each AP’s captive-portal page confuses portal TLS with client EAP identity. Using expired certificates deliberately so RADIUS rejects roaming clients is operational sabotage.
Exam caveat: plan renewal windows and SCEP/EST or MDM enrollment before the first mass cutover. Operational check: enroll a pilot OU, renew and revoke a certificate end-to-end, confirm RADIUS behavior matches, and measure help-desk steps for a lost-device revoke. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.