WLAN engineers must choose trust anchors for RADIUS server certificates used by city EAP clients. Which design choice is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Clients need a trust map to the real RADIUS server the way browsers need a path to a website’s CA. Whether the city runs a private CA or uses a public one, that chain has to be intentional and installable on endpoints. Fake-looking SSIDs and MAC lists are not a PKI plan.
Full Explanation
Selecting trust anchors for RADIUS server certificates in a city’s EAP authentication infrastructure requires deliberate choice between private and public Certificate Authority (CA) models to ensure clients can validate a coherent trust chain to the AAA server certificate. This validation prevents man-in-the-middle attacks and establishes trust in the authentication server. Using any self-signed Access Point (AP) certificate based solely on an official-looking SSID name is insecure, as clients cannot verify authenticity without a trusted CA signature, leading to potential spoofing. Skipping server certificates and relying only on MAC filtering is inadequate because MAC addresses can be spoofed and do not provide cryptographic assurance of server identity. Preferring expired certificates ignores validity periods critical for security; clients typically reject expired certificates, causing authentication failures. The caveat is that public CAs offer broad trust but may incur costs and complexity, while private CAs require secure distribution of root certificates to clients. Operationally, ensure that client devices trust the chosen CA and that server certificates are valid and correctly configured, allowing seamless EAP authentication without certificate warnings or failures.