Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

11-8
RADIUS Server
RADIUS Authentication
Specifying the RADIUS Server’s Digital Certificate
As an authentication server, the Wireless Edge Services xl Module requires
various certificates:
■ a server certificate
No matter which EAP type you select, the internal RADIUS server must
authenticate itself using a digital certificate.
By default, the module identifies itself to users with the server certificate
in the default-trustpoint. This certificate is installed on the module when
it ships and is self-signed with the name Hewlett-Packard.
Alternatively, the module can authenticate itself with one of these
certificates:
• a self-signed certificate that you create on the module
• a digital certificate signed by a trusted certificate authority (CA) and
installed on the module
■ a CA certificate
The Wireless Edge Services xl Module uses the public key in the CA
certificate to verify certificates signed by that CA.
For example, for EAP-TLS, the RADIUS server checks users’ digital
certificates. So the server needs the CA certificate for the CA that signed
the users’ digital certificates.
On the Wireless Edge Services xl Module, you create trustpoints and load
certificates into those trustpoints. Install the correct certificates before com-
pleting the following tasks for the RADIUS server:
■ selecting which of the module’s own digital certificates it should use to
authenticate to users (mandatory)
■ selecting which of the module’s CA certificates it should use to
authenticate users (for EAP-TLS)
See “Digital Certificates” on page 2-165 of Chapter 2: Configuring the
ProCurve Wireless Edge Services xl Module for instructions on creating
trustpoints.