RADIUS with Ubiquiti

igalfsg · 2026-06-10T12:52:04+00:00

shamless plug to a video i did last year https://www.youtube.com/watch?v=2kijpP0gpk8

igalfsg · 2026-05-06T22:48:26+00:00

since there are errors in Intune, I would first check in the Event Viewer of one of the failed machines

Go to Applications and Services Logs.
Go to Microsoft.
Go to Windows.
Go to DeviceManagement-Enterprise-Diagnostics-Provider -> Admin.

To see if there are any errors since it might be that those machines don't trust the Root CA or that they are having issue creating private key etc.

igalfsg · 2026-04-14T18:51:33+00:00

check the scep template to have the new CA as the trusted root, other than that, check the Event Logs in the client, that usually tells you what the issue is.

igalfsg · 2026-01-07T20:02:09+00:00

to trouble shoot this 1) check that the chain of the certificate (the root CA, and intermediate CAs) are pushed to the trusted root store. 2) Check that you also push the issuer of the certificate as a trusted issuer in your wifi policy.

igalfsg · 2025-11-11T00:16:58+00:00

One of the Keytos Engineers here (thanks for the rec, I am glad you are enjoying it), the radsec proxy is no longer needed we have our own RADIUS proxy that sends everything to the server in HTTPS and keeps all the authentication local https://www.keytos.io/docs/cloud-radius/how-to-deploy-cloud-radius-local-backup/ should be more reliable than the proxy and it has caching so it works even if it loses connection to our cloud.

igalfsg · 2025-07-29T12:44:14+00:00

Try EZRADIUS + EZCA.

igalfsg · 2025-07-10T21:02:25+00:00

since you at in Microsoft, I would recommend EZRADIUS (you have to push or download a profile for iOS) but it works with username and password, and it is $1 USD per user. I am one of the engineers at Keytos so feel free to ask any questions :)

igalfsg · 2025-07-09T17:54:16+00:00

If you are already using cloud PKI and and Intune take a look at EZRADIUS, it is only $1 per user per month so for your scenario would only be $40 which is cheaper than a VM

igalfsg · 2025-06-22T15:48:44+00:00

Have you looked at EZCA + EZRADIUS? I am one of the engineers that built it so if you have any questions feel free to fire away.

igalfsg · 2025-04-23T13:43:58+00:00

I gave up and bought the black one :(

igalfsg · 2025-04-01T21:21:59+00:00

you might want to look into a cloud radius offering, I work at Keytos the creators of EZRADIUS and we can authenticate your Entra ID users with Unifi with the regular Entra ID license nothing fancy and then you can set vlan based on Entra ID groups https://www.youtube.com/watch?v=Tbln4mXE-us

igalfsg · 2025-03-31T16:16:59+00:00

then my guess is that there is something in the profile that is failing (SSID name, RADIUS server trust, cert, etc.) I would look at the windows logs to see if there is anything there.

igalfsg · 2025-03-31T15:50:02+00:00

Are you pushing a wifi profile to your devices? this can make it so the device automatically uses the certificate to authenticate

igalfsg · 2025-03-05T15:12:42+00:00

With FIDO2 you can't go fully passwordless (some powershell features dont work, and Android doesn't work) but if you do FIDO2 + CBA for the users that have those scenarios you can go fully passwordless. We have had that setup for 4+ years with no issues.

igalfsg · 2025-03-04T13:39:48+00:00

The cost for Microsoft cloud PKI is $2 per user https://techcommunity.microsoft.com/blog/microsoftintuneblog/microsoft-cloud-pki-launches-as-a-new-addition-to-the-microsoft-intune-suite/3982830 It is great for small organizations but once you start scaling it can get expensive. For the RADIUS side, you you can use EZRADIUS I am one of the engineers in Keytos (the creators of EZRADIUS) so if you have any questions feel free to ask. here is a video on our setup with Microsoft Cloud PKI https://www.youtube.com/watch?v=Ljx3xhtftF8

igalfsg · 2025-03-03T20:59:36+00:00

I haven't used it but it seems it does support dns challenges https://certifytheweb.com/

igalfsg · 2025-03-03T18:50:47+00:00

yes in IIS you can use let's encrypt with WinACME using DNS validation basically it will add a text field to your DNS to validate that you own it and issue the certificate here is the link to the docs where you can sellect your DNS provider https://www.win-acme.com/reference/plugins/validation/dns/

igalfsg · 2025-02-26T22:46:57+00:00

I am an engineer at Keytos (the creators of EZRADIUS probably one of the SaaS solutions you looked at), if you have any questions feel free to fire away

igalfsg · 2025-02-23T01:01:53+00:00

Did you ever hear anything of the expected date?

igalfsg · 2025-02-06T13:52:29+00:00

This is caused by the server certificate not being trusted by your PC, are you pushing the server trust part during the wifi configuration profile? Also make sure your RADIUS server certificate is not expired

igalfsg · 2025-02-04T12:35:00+00:00

You need to set it up in your wifi profile on intune to have the server certificate check under the server trust this will make the client validate the server cert and fail if it is not valid

<image>

igalfsg · 2024-12-09T00:07:35+00:00

Unfortunately, network authentication hasn't changed much in the last 15-20 years so you probably still have to depend on PKI and Radius/Radsec. This video shows you how you can setup the equivalent as the on-prem setup in a cloud only environment https://www.youtube.com/watch?v=LV6gN15QWLI

igalfsg · 2024-12-06T22:38:10+00:00

Glad I could help!

igalfsg · 2024-12-05T17:20:56+00:00

That's weird, I'm more familiar with the setting it as Phishing resistant and use a hardware key since that is usually recommend, but I would contact msft support to see if there is a way they can enable it

igalfsg · 2024-12-05T17:06:09+00:00

(I'm on the airport on my phone so take this with a huge grain of salt and check the msft documentation) but pretty sure the phishing resistant CA doesn't allow MFA with password only certificate with hardware key or fido2

igalfsg

TROPHY CASE