How to install FreeRADIUS EAP-TLS Configuration on Ubuntu 20.04 — Complete Working Setup
In this video, we’ll install FreeRADIUS EAP-TLS Configuration on Ubuntu 20.04, step-by-step — perfect for beginners, students, and network engineers preparing for certifications like CCNA, CCNP, or Network+.
🧠 FreeRADIUS is one of the most widely used open-source RADIUS servers for network authentication, authorization, and accounting. Understanding how it works will help you in enterprise network setups, Wi-Fi authentication, and 802.1X deployments.
⚙️ Commands Used in This Video:
STEP 1 — Install FreeRADIUS & required tools
sudo apt update
sudo apt install freeradius freeradius-utils openssl -y
STEP 2 — Create a new working PKI directory
sudo mkdir -p /etc/freeradius/certs-eap
sudo chmod 700 /etc/freeradius/certs-eap
cd /etc/freeradius/certs-eap
STEP 3 — Create CA configuration file
sudo nano /etc/freeradius/certs-eap/ca.cnf
STEP 4 — Generate CA keys & certificate
cd /etc/freeradius/certs-eap
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -config ca.cnf -out ca.pem
STEP 5 — Create Server Certificate
5a. Create server.cnf
sudo nano /etc/freeradius/certs-eap/server.cnf
cd /etc/freeradius/certs-eap
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -config server.cnf
5b. Generate server key and CSR
cd /etc/freeradius/certs-eap
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -config server.cnf
5c. Sign the server certificate
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.pem -days 3650 -sha256 -extfile server.cnf -extensions ext
STEP 6 — Create Client Certificate
6a. Create client.cnf
sudo nano /etc/freeradius/certs-eap/client.cnf
6b. Generate client key & CSR
cd /etc/freeradius/certs-eap
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr -config client.cnf
6c. Sign client certificate
openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem -days 3650 -sha256 -extfile client.cnf -extensions ext
6d. Export to P12 for Windows/macOS/iOS
openssl pkcs12 -export -inkey client.key -in client.pem -certfile ca.pem -out client.p12
STEP 7 — Configure FreeRADIUS to use EAP-TLS
sudo nano /etc/freeradius/3.0/mods-enabled/eap
STEP 8 — Add your Access Point / WiFi Controller
sudo nano /etc/freeradius/3.0/clients.conf
STEP 9 — Restart and test FreeRADIUS
systemctl restart freeradius
STEP 10 — Connect with the client certificate