Skip to main contentSkip to search
Skip to main content

IronWiFi PKI Infrastructure

IronWiFi provides a multi-tiered, HSM-backed Certificate Authority (CA) infrastructure for secure certificate-based WiFi authentication. This document describes the PKI architecture and provides certificate fingerprints for verification.

Architecture Overview​

IronWiFi offers a modular PKI architecture supporting both:

  • Hybrid PKI - Customer's signing CA is signed by IronWiFi's Root CA
  • Private PKI - Customers generate their own keypair for signing, which can be:
    • Securely transferred to IronWiFi for import into HSM-based KMS
    • Accessed from the customer's own CloudHSM solution

Security Features​

HSM-Based Key Management​

All Intermediate Signing CA private keys are stored in geo-redundant, private cloud-based Key Management Servers (KMS) using Hardware Security Modules (HSMs):

  • Key generation - All private keys are generated directly on HSMs
  • Key protection - Private keys can never be exported from the HSM
  • Geographic redundancy - Keys are replicated across multiple regions
  • Access control - Strict authentication for all key operations

API Security​

Communication between the SCEP issuing server and KMS is protected by:

  • HMAC authentication - All API calls are cryptographically authenticated
  • Client certificate verification - Mutual TLS for server authentication
  • Key rotation - Client certificates are rotated after each API call

Certificate Authority Hierarchy​

IronWiFi uses a three-tier PKI hierarchy:

Root Certificate Authority​

The Root CA is the trust anchor for the entire PKI:

  • Offline and air-gapped for maximum security
  • HSM-protected private key
  • Used only to sign Intermediate CA certificates

Intermediate Certificate Authorities​

CA NamePurpose
SCEP Signing Intermediate CASigns certificates requested via SCEP protocol
Client Signing Intermediate CASigns end-user and device certificates
RadSec Signing Intermediate CASigns certificates for RadSec (RADIUS over TLS)
Signing Intermediate CAGeneral-purpose certificate signing

Certificate Fingerprints​

Use these SHA256 fingerprints to verify the authenticity of IronWiFi certificates.

Root CA​

PropertyValue
NameIronWiFi Root CA
SHA256 Fingerprint

SCEP Signing Intermediate CA​

PropertyValue
NameIRONWIFI SCEP Signing Intermediate Certificate Authority
SHA256 Fingerprint

Client Signing Intermediate CA​

PropertyValue
NameIRONWIFI Client Signing Intermediate Certificate Authority
SHA256 Fingerprint

RadSec Signing Intermediate CA​

PropertyValue
NameIRONWIFI RadSec Signing Intermediate Certificate Authority
SHA256 Fingerprint

Signing Intermediate CA​

PropertyValue
NameIRONWIFI Signing Intermediate Certificate Authority
SHA256 Fingerprint

Verifying Certificate Fingerprints​

Windows​

macOS / Linux​

Browser​

  1. Click the padlock icon in the address bar
  2. View certificate details
  3. Find SHA-256 fingerprint in certificate info

SCEP Integration​

The Simple Certificate Enrollment Protocol (SCEP) allows devices to automatically enroll for certificates:

  1. Device sends Certificate Signing Request (CSR) to SCEP URL
  2. SCEP server validates request using shared secret
  3. Request is forwarded to KMS for signing
  4. Signed certificate is returned to device

SCEP URL Format​

note

For Windows/Intune profiles, remove 

/scep
from the URL as Intune appends it automatically.

Required Parameters​

ParameterDescriptionExample
region
Your data residency region
us-east1
, 
console
, 
asia-northeast1
owner_id
Your IronWiFi account identifierFound in console URL

Downloading CA Certificates​

  1. Log in to the IronWiFi Console
  2. Navigate to Account > Certificates
  3. Download the required certificates:
    • IronWiFi CA Certificate - For SCEP profiles
    • Trusted RADIUS Server Certificate - For WiFi profiles

Was this page helpful?