Systems Manager can be used with Cisco Meraki wireless networks to easily deploy certificate-based (EAP-TLS) authentication to iOS, Android, OS X, and Windows clients. This is ideal for customers who want to seamlessly and securely (using WPA2) authenticate users while avoiding the additional requirements of an external RADIUS server. This article will cover an example of how to implement this solution.

• Meraki authentication
• Multi-factor Authentication

Each device enrolled in Systems Manager is given a unique SCEP certificate. This method also allows users to authenticate to the same SSID with a username and password. However, user credentials will need to be managed from the Users page.

When setting up the certificate authentication, a full certificate chain is needed for EAP-TLS authentication with Cisco Meraki Wi-Fi, which may require third-party certificates or additional certificate management.

The certificate must be in the following format :

-----BEGIN CERTIFICATE-----
.... (entity certificate contents)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
.... (Intermediate certificate contents)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
.... (Trusted root certificate contents (Optional. Only required for self-signed chains))
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
.... (entity private key contents)
-----END RSA PRIVATE KEY-----

NOTE:
Okta Certificates do not provide the full certificate chain.

Related References

• Create certificate chains
• Certificate-based Wi-Fi authentication with Systems Manager and Meraki APs
• Does Okta RADIUS Supports Client Certificates for EAP-TTLS Integration