EAPTLS

EAP-TLS, short for Extensible Authentication Protocol-TLS, is an EAP method that uses Transport Layer Security to provide mutual authentication and a protected channel for network access. It is widely used in 802.1X deployments for both wired and wireless networks, and is valued for its strong security when a proper Public Key Infrastructure (PKI) is in place. EAP-TLS relies on X.509 certificates rather than static passwords.

In operation, both client and server authenticate using certificates. The client presents its certificate to the server and the server presents its certificate to the client. A TLS handshake establishes a secure, encrypted channel. Once the TLS session is up, EAP messages are exchanged inside this protected tunnel, and the authentication outcome is conveyed to the network access server or authenticator. The method is typically encapsulated within the inner EAP exchange of an 802.1X authentication sequence.

Deployment considerations include the need for PKI infrastructure: issuing and distributing client certificates to devices, deploying trusted CA certificates on clients, and provisioning server certificates on RADIUS or AAA servers. Certificate lifetimes, revocation (CRL or OCSP), and secure storage of private keys are important. EAP-TLS can require significant initial setup for certificate enrollment and ongoing maintenance, and it results in higher device-level processing and storage demands.

Security and practicality: EAP-TLS provides strong mutual authentication and protects credentials from interception since passwords are not transmitted. Its main limitations are PKI complexity and the need for certificate management. It is often compared to other EAP methods such as PEAP or EAP-TTLS, which use certificates differently and may protect inner credentials with different mechanisms.