Miloš Mijić
Public case study · architecture only

Systems / Network identity

Certificate, not password.

Passwordless Wi-Fi deployed and maintained across global offices with Linux FreeRADIUS, EAP-TLS, managed device certificates and UniFi enforcement.

Trust path

Choose a stage to inspect its responsibility and boundary.

Stage 01

Go operations platform

The platform coordinates managed enrollment and supplies the context needed to assign network identity through device management.

Implementation

Go service workflows and authenticated management interfaces.

Boundary

It coordinates enrollment but does not act as the network authenticator.

Stage 02

Jamf Pro

Jamf targets the appropriate managed devices and distributes both identity and network configuration without manual user setup.

Implementation

MDM configuration profiles and managed scope.

Boundary

Only enrolled, managed devices receive the profile chain.

Stage 03

Device certificate and Wi-Fi profile

The certificate represents the managed device, while the Wi-Fi profile tells the operating system how to present that identity.

Implementation

Managed certificate payload plus EAP-TLS Wi-Fi payload.

Boundary

The public case study omits certificate templates, identifiers and profile values.

Stage 04

EAP-TLS

The connection proves possession of a trusted device certificate instead of sending or sharing a Wi-Fi password.

Implementation

Mutual certificate authentication at network join time.

Boundary

An unverifiable certificate produces a failed authentication, not a fallback credential.

Stage 05

FreeRADIUS

A self-hosted Linux RADIUS service validates the certificate chain and evaluates network admission policy.

Implementation

FreeRADIUS configured for EAP-TLS and managed trust roots.

Boundary

Trust and policy are evaluated centrally; secret configuration is not exposed here.

Stage 06

UniFi

UniFi forwards authentication to RADIUS and enforces the resulting allow or reject decision at the network edge.

Implementation

Managed access points, site policy and RADIUS integration.

Boundary

The page shows the responsibility split without publishing topology.

Stage 07

Network access

A managed device joins seamlessly only after the complete identity and enforcement chain succeeds.

Implementation

Consistent policy across offices with supporting VPN, DNS and HTTP controls.

Boundary

Access remains denied when identity cannot be proven.

How the trust path is built

Four layers, each with one clear responsibility.

Orchestration

Go control plane

The Go operations platform coordinates the enrollment workflow and hands managed-device configuration to Jamf Pro.

MDM

Certificate distribution

Jamf Pro distributes the device certificate and Wi-Fi profile, so network identity arrives through device management rather than user setup.

Authentication

Linux FreeRADIUS and EAP-TLS

I self-hosted and configured FreeRADIUS to validate certificate-backed device identity without a shared Wi-Fi password.

Network operations

Global office infrastructure

I configured and maintained UniFi networking, VPN access, DNS controls and HTTP firewall policies across global offices. UniFi applies each RADIUS access decision.

Sanitized system view

Managed trust, end to end.

Representative workflow using no certificate, topology or office data.

Enrollment / Assign

Managed network profile

Profile assigned

Coordinate enrollment so certificate identity and network configuration arrive through device management.

Enrollment context

Managed device + platform workflow

Delivery

Jamf scope + configuration profile

Assignment checks

  • Device is managed
  • Certificate payload is scoped
  • Wi-Fi profile references identity
  • User setup is not required

EAP-TLS / Validate

Managed device identity

Identity valid

Review the managed certificate chain before a device can present network identity.

Provisioning

Go platform + Jamf Pro

Certificate trust

Managed identity + trusted CA chain

Trust checks

  • Device certificate is installed
  • Wi-Fi profile is managed
  • Certificate chain is trusted
  • No shared-password fallback

Policy / Decide

Network admission decision

Policy evaluable

Evaluate certificate-backed identity against an explicit access policy before network admission.

Authentication

EAP-TLS request + certificate identity

Policy engine

FreeRADIUS validation + UniFi enforcement

Decision checks

  • Certificate is within validity
  • Issuer is trusted
  • Identity matches policy
  • Rejected identity stays rejected

Network / Maintain

Office policy consistency

Configuration aligned

Keep the same device-identity model consistent while each office retains its appropriate network scope.

Managed scope

Office profile + network destination

Operational controls

UniFi policy + VPN, DNS and HTTP controls

Consistency checks

  • Trust path is consistent
  • Site scope is explicit
  • Network controls are maintained
  • No topology is exposed here

Experience

Users connect without entering a shared password. The seamless experience is the visible result of managed identity underneath.

Proof in the build
Jamf Pro distributes both the device certificate and Wi-Fi profile, so managed devices receive network identity without manual user setup.

Failure behavior

If device identity cannot be verified, access is rejected rather than guessed.

Proof in the build
FreeRADIUS validates the EAP-TLS identity and UniFi enforces that decision, with no fallback to a shared credential.

Public boundary

Architecture and user experience only, with no topology, certificate profiles, secrets or operational runbooks.