Discover our products
Try for free
enen
DeutschGermanDEEnglishEnglishENEspañolSpanishESFrançaisFrenchFRSvenskaSwedishSVSuomiFinnishFIDanskDanishDA한국어KoreanKONederlandsDutchNLItalianoItalianITÍslenskaIcelandicISNorskNorwegianNO日本語JapaneseJA

Written in English, translated by Claude. Something lost in translation? Please tell us.

CERTIFICATES

RADIUSaaS verifies every certificate against the CAs you trust

RADIUSaaS accepts certificates from SCEPman, Microsoft Cloud PKI, your on-premises PKI or any other CA that issues client certificates, several of them at once. For each CA you decide what it is trusted for and how revocation is verified.

  • Several CAs in parallel
  • OCSP or CRL per CA
  • Soft or hard fail
  • Server certificate renewal through SCEPman
Try RADIUSaaS nowTry the revocation check
Example data.
TRUST

Trust the CAs you already have

Upload a CA certificate as a PEM or DER file, or give RADIUSaaS the URL of your SCEPman and it fetches the CA certificate itself. Then say what the CA is trusted for: client authentication for your devices, RadSec for your access points and switches, or both.
  • Rules can limit themselves to certain CAs, so a certificate from your lab CA never lands in the production VLAN
  • Certificates expiring within 60 days are flagged in the list
  • Search by subject or thumbprint
Example data.
TRY IT

What happens when a certificate is revoked

Pick how RADIUSaaS verifies revocation for a CA, pick what is going on, and see whether the device gets in.

How RADIUSaaS verifies this CA
What is going on
Accepted

Accepted. The responder confirmed the certificate.

Example data.

METHODS

Four ways to verify revocation

The four revocation checks per trusted CA
MethodHow it worksWhen to choose it
Static OCSP responder URLRADIUSaaS queries the OCSP responder at the URL you enter about each certificate at sign-in. Answer within 2 seconds, or soft fail decides.Your CA runs a responder, as SCEPman does.
Dynamic OCSP responder URL (AIA)Like the static URL, with the responder URL read from each certificate's AIA extension.Several responders, or you don't want to enter one. Slower on every login.
Certificate revocation list (CRL)RADIUSaaS verifies against its copy of your CA's CRL, delta CRLs included. It looks at the CRL every hour and downloads it again when it expires or once the copy is three hours old.High authentication volume, or a CA that publishes only CRLs, like Microsoft Cloud PKI.
NoneNo revocation check.Test tenants only.

Soft or hard fail is set per CA. RADIUSaaS can also verify the revocation status of the CA certificate itself on every authentication; it is off by default to keep logins fast.

SERVER CERTIFICATE

The server certificate your devices verify

Before a device presents its own certificate, it verifies the one RADIUSaaS presents. By default RADIUSaaS creates a dedicated CA, used for nothing but your server certificate, and issues the certificate from it. Prefer your own? Upload a certificate with the server authentication usage as PEM or PKCS#12, as long as it isn't self-signed. You decide which certificate is active, and you can download the CA for your device profiles at any time.
  • A customer CA unique to your instance
  • Your own server certificate, from any CA your devices trust
  • One click to switch the active certificate
Example data.

The server certificate renews itself through SCEPman

Connect your SCEPman, and the server certificate takes care of itself. With SCEPman as a Service, the connection is already in place.
  • Connect
    Connect
    Enter your SCEPman URL in RADIUSaaS and the token RADIUSaaS shows you in SCEPman.
  • Pregenerate
    Pregenerate
    RADIUSaaS requests a server certificate without activating it, so you can check that your device profiles trust it.
  • Set up
    Set up
    From then on RADIUSaaS activates the certificate and renews it before it expires.
EXPIRY

See which certificates expire next

  • Filters for expiring certificates

    Trusted and server certificates expiring within 60 days get their own filter and status.

  • Health view

    The service state page lists certificates, revocation lists, proxies and SCEPman with their status: valid, expiring, expired, up or down.

  • Warnings in the portal

    The portal raises expiring certificates as notifications, so the first warning isn't a help desk call.

Your CA with a RADIUS server you don't have to run

Upload your CA in the trial, choose how revocation is verified and connect your first device.

Try RADIUSaaS nowSee SCEPman as a Service