HA RADIUS certificates

Two HA nodes must have different OS hostnames, management IP addresses, SSH host keys and management HTTPS identities. Those node identities stay local. The primary’s signed configuration snapshot copies the shared NAC policies, the RADIUS EAP server certificate and private key, and the EAP trust bundle to the secondary.

Snakeoil certificate warning

If the secondary says FreeRADIUS is presenting the distribution default snakeoil certificate, the copied PEM files have not been activated in its EAP module. Supplicants that validate the server certificate can reject authentication. Do not treat “HA in sync” alone as proof that 802.1X is ready. Apply the release containing the EAP activation fix, inspect the HA import result and check that FreeRADIUS is healthy. Activation failures use support code PGN-HA-EAP-001.

Verify both RADIUS nodes

1. Confirm both nodes use the expected RADIUS certificate fingerprint and trusted issuer.
2. Confirm the certificate contains the server name that client 802.1X profiles are configured to trust. A certificate valid only for the primary IP is not automatically valid when a profile expects the secondary IP.
3. Authenticate a test supplicant against the primary and then the secondary RADIUS address. Verify certificate validation, authorization and the assigned VLAN for both.
4. Record the result and time. If either test fails, keep the HA deployment in supervised mode and investigate before production acceptance.

Never send RADIUS private keys or recovery codes to support. Share certificate fingerprints, redacted logs, the support code and the installed release instead.