Miloš Mijić
Public case study · architecture only

Systems / Network identity

Certificate, not password.

Passwordless Wi-Fi deployed and maintained across global offices with Linux FreeRADIUS, EAP-TLS, managed device certificates and UniFi enforcement.

Trust path

  1. Go operations platform
  2. Jamf Pro
  3. Device certificate and Wi-Fi profile
  4. EAP-TLS
  5. FreeRADIUS
  6. UniFi
  7. Network access

How the trust path is built

Four layers, each with one clear responsibility.

Orchestration

Go control plane

The Go operations platform coordinates the enrollment workflow and hands managed-device configuration to Jamf Pro.

MDM

Certificate distribution

Jamf Pro distributes the device certificate and Wi-Fi profile, so network identity arrives through device management rather than user setup.

Authentication

Linux FreeRADIUS and EAP-TLS

I self-hosted and configured FreeRADIUS to validate certificate-backed device identity without a shared Wi-Fi password.

Network operations

Global office infrastructure

I configured and maintained UniFi networking, VPN access, DNS controls and HTTP firewall policies across global offices. UniFi applies each RADIUS access decision.

Sanitized system view

Managed trust, end to end.

Representative workflow using no certificate, topology or office data.

EAP-TLS / Validate

Managed device identity

Identity valid

Review the managed enrollment and enforcement chain before a device is allowed onto the network.

Provisioning

Go platform + Jamf Pro

Enforcement

FreeRADIUS + UniFi

Trust checks

  • Device certificate is installed
  • Wi-Fi profile is managed
  • Certificate chain is trusted
  • No shared-password fallback

Experience

Users connect without entering a shared password. The seamless experience is the visible result of managed identity underneath.

Proof in the build
Jamf Pro distributes both the device certificate and Wi-Fi profile, so managed devices receive network identity without manual user setup.

Failure behavior

If device identity cannot be verified, access is rejected rather than guessed.

Proof in the build
FreeRADIUS validates the EAP-TLS identity and UniFi enforces that decision, with no fallback to a shared credential.

Public boundary

Architecture and user experience only, with no topology, certificate profiles, secrets or operational runbooks.