RADIUS Certificates

RADIUS Certificates manages the PKI (Public Key Infrastructure) required for WPA2-Enterprise authentication. This module handles the full certificate lifecycle — from generating the tenant's root certificate authority, through issuing server certificates for the RADIUS server, to provisioning and revoking per-user client certificates issued during the enterprise enrolment journey.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/radius-cert/overview.png

Certificate Hierarchy

WPA2-Enterprise relies on a three-tier certificate chain. Understanding this hierarchy is essential for correctly deploying and maintaining your enterprise WiFi PKI.

Root CA (Certificate Authority)

The Root CA is the cryptographic foundation of your enterprise WiFi PKI. It is a self-signed X.509 certificate that Kiwire uses to sign all server and client certificates. Key facts:

• Generated once per tenant. A new Root CA invalidates all previously issued server and client certificates — avoid regenerating unless strictly necessary.
• The Root CA itself is not sent to client devices during EAP authentication; it must be distributed out-of-band (via MDM or manual install) so that devices can verify the chain of trust.
• Stored securely on the server. The private key is never exported or accessible through the admin interface.
• Download the Root CA public certificate in PEM format from this page, then push it to client devices via your MDM (Jamf, Intune, Mosyle) or distribute it in your corporate onboarding guide.

Server Certificate

The Server Certificate is presented by the RADIUS server to client devices during EAP negotiation. The client device checks that this certificate is signed by the trusted Root CA before proceeding with authentication. Key facts:

• Signed by the tenant Root CA.
• Installed on the RADIUS server (FreeRADIUS or similar) that handles EAP authentication for enterprise SSIDs.
• The certificate's Common Name (CN) should match or include the RADIUS server's hostname or IP address.
• Available for download in PEM format for installation on the RADIUS server.
• Renewing the Server Certificate does not affect client certificates — only the RADIUS server needs to be updated with the new cert and key.

Client Certificates

Client certificates are issued per-user, per-device during the enterprise enrolment journey. They allow the RADIUS server to authenticate users via EAP-TLS (mutual certificate authentication) without requiring the user to enter a password on each connection. Key facts:

• Signed by the tenant Root CA.
• Generated automatically when a user successfully completes an Enterprise Journey.
• The certificate's CN typically includes the user's identity (username or email) for easy identification in RADIUS logs.
• Validity period is controlled by the cert_expiry setting on the Enterprise Login Method used in the journey.
• A reference to the certificate (cert_name) is stored on the user's Kiwire account record, linking the user to their issued certificate.

Certificate Formats

Format	Extension	Use case
PEM	.crt / .pem	RADIUS server installation, CA distribution, Linux/macOS systems, MDM profiles
PKCS#12	.p12	Easy import on Windows, iOS, and Android — bundles certificate + private key into a single password-protected file
DER	.der	Binary format for systems that do not accept PEM; less common

Client certificates are available for download in both PEM and P12 formats from the client certificate detail view. The P12 file is protected with a passphrase that is shown to the user during the enrolment journey — it is not stored by Kiwire.

Expiry and Renewal

Kiwire monitors certificate expiry and displays warning badges on certificates nearing their expiry date (default warning threshold: 30 days before expiry).

Certificate	Renewal process	Impact
Root CA	Generate a new Root CA. All other certs must be re-issued.	All users disconnected until devices receive new CA + new client cert.
Server Certificate	Generate a new server cert (signed by the same Root CA). Install on RADIUS server.	Brief interruption on RADIUS server restart. Client devices do not need changes.
Client Certificate	User repeats the Enterprise Journey to get a new certificate issued.	Individual user only. Other users unaffected.

Certificate Storage

All certificate files are stored on the local disk (not the public disk — they are never publicly accessible via URL):

Certificate storage contains the Root CA key pair, the Server Certificate and key, and all issued client certificates. It is included in the tenant data reset cleanup routine and is backed up as part of the application storage backup.

Available Actions

Action	Description
Generate CA	Create the tenant's Root CA certificate and key pair. Only available if no Root CA exists. If a CA already exists, use with extreme caution — this replaces the existing CA.
Generate Server Cert	Issue a new Server Certificate signed by the Root CA. Requires an existing Root CA. The generated cert and key are ready for download and installation on the RADIUS server.
View	Display the certificate details — subject, issuer, validity period, serial number, and fingerprint.
Download	Download the certificate in PEM or P12 format. P12 download prompts for a passphrase to encrypt the private key.
Revoke	Mark a client certificate as revoked. Revoked certificates are rejected by the RADIUS server. Use when a device is lost, stolen, or a user leaves the organisation.

Required Permissions

view-radius-certs · create-radius-certs · delete-radius-certs