> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Configure 802.1x with SCEP

> Create a SCEP certificate enrollment profile, enable 802.1x in a project policy, and mark node network adapters as 802.1x-eligible.

## Introduction

This procedure explains how to configure 802.1x port-based network access control (PNAC) on nodes managed by Edge Infrastructure Services. You will create a certificate enrollment profile that defines how EVE-OS (Edge Virtualization Engine) obtains and renews device certificates via SCEP, attach that profile to a project, and mark the appropriate network adapters as 802.1x-eligible.

Complete these steps before deploying nodes into enterprise network environments that require certificate-based port authentication. For background on how 802.1x and SCEP work in EVE-OS, see [802.1x Port-Based Network Access Control Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/networks/802-1x-overview.md).

![Diagram showing the 802.1x SCEP certificate enrollment flow between a node, network switch, RADIUS server, SCEP server, and Edge Infrastructure Services](https://mintcdn.com/zededa/nH470gZ2VKSQBZu8/new-ui/infrastructure-services/networks/images/pnac_scep.png?fit=max\&auto=format\&n=nH470gZ2VKSQBZu8\&q=85\&s=e32129a6a6e54483f71cfb2ff43d99f3)

## Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* A SCEP-compatible Certificate Authority (CA) accessible either directly from the node's bootstrap VLAN or from Edge Infrastructure Services (via the controller SCEP proxy). You need the SCEP server URL and a challenge password.
* CA certificate bundle in PEM format (root CA and any required intermediate CAs), ready for upload.
* A project where you will add the 802.1x policy. Create the project before continuing if it does not exist.
* Nodes running EVE-OS 14.5.0-LTS or later.

## Prepare Your Network Equipment

### Configure the network switch

The switch connected to your node ports must be a managed switch with IEEE 802.1x support. Configure the following on each port that will connect to an EVE-OS node:

**Enable 802.1x port authentication.** Enable IEEE 802.1x on each switch port and configure a RADIUS server as the authentication backend. The RADIUS server must be configured to validate EAP-TLS client certificates.

**Configure two VLANs.** The switch requires two VLANs to support the certificate bootstrapping flow:

* **Bootstrap VLAN** (also called a guest or auth-fail VLAN): Provides limited network access. The node must be able to reach Edge Infrastructure Services and the SCEP server from this VLAN. The switch assigns this VLAN to the port when the device is not yet authenticated.
* **Authenticated VLAN**: Provides full network access. The switch moves the port to this VLAN after a successful 802.1x authentication.

**Configure vendor class identifier recognition.** Configure the switch or DHCP server to recognize the **LFEDGE-EVE** vendor class identifier (DHCP Option 60) and allow traffic to Edge Infrastructure Services from the bootstrap VLAN. If your switch does not support vendor class identifier-based policy, you can allow all traffic from the bootstrap VLAN to the Edge Infrastructure Services IP address.

### Configure the SCEP server

Configure the following on your SCEP server:

* A CA certificate and private key for signing enrolled device certificates.
* A challenge password (shared secret) that devices use to authenticate their enrollment requests.
* The CA certificate used by the SCEP server must also be configured in the RADIUS server's EAP-TLS settings as a trusted CA for client certificate validation.

## Create a Certificate Enrollment Profile

A certificate enrollment profile defines the connection to your SCEP server and the certificate attributes EVE-OS uses when requesting device certificates. You create this profile once and attach it to one or more projects.

1. In the header, click your **profile avatar**.
2. Click **Enterprise Settings**.
3. Click the **Security** tab.
4. Click the **Device & Network Trust** sub-tab.
5. In the **Certificate Enrollment Profiles** section, click the **Create Profile** button.

### Configure identity

1. In the **Name** field, enter a unique identifier for the profile. The name cannot contain spaces.
2. In the **Display Title** field, enter a human-readable label for the profile.
3. In the **Description** field, enter an optional description.

### Configure SCEP

1. In the **SCEP URL** field, enter the full URL of your SCEP server endpoint (for example, `https://scep.example.com/scep` or `https://scep.example.com:8080/scep`).
2. In the **Challenge Password** field, enter the pre-shared challenge password configured on your SCEP server.
3. Enable the **Use controller proxy** toggle if your SCEP server is not directly reachable from the bootstrap VLAN. When enabled, Edge Infrastructure Services relays SCEP requests to the server on behalf of the node.

### Configure the certificate authority

1. In the **Certificate Authority** section, paste your CA certificate chain in PEM format, or click **Upload PEM** and select the file. Upload the root CA and all required intermediate CAs.

### Configure the CSR profile

The CSR profile section defines the certificate subject. Edge Infrastructure Services supports dynamic variable substitution so that every device receives a unique certificate. For the full list of supported system variables, see [Custom Configuration for Applications](https://zededa.mintlify.site/new-ui/marketplace/custom-app-configuration.md).

1. In the **Common Name Template** field, enter a value or variable:
   * To use the node's system-generated ID: `$zri.system.edge-node.id`
   * To use the node's name: `$zri.system.edge-node.name`
   * To use the hardware serial number: `$zri.system.edge-node.serial`
2. Optionally, complete the **Organization**, **Organizational Unit**, **Country**, **State**, and **Locality** fields.
3. In the **SAN URI** field, enter a URI value or variable, for example `URN:Serial:$zri.system.edge-node.serial`.
4. Optionally, enter a **SAN Email** if your CA policy requires one.

### Configure key and renewal settings

1. Under **Key Family**, **RSA** is the supported key family for this release.
2. Select the **RSA Key Size** from the dropdown.
3. Select the **Hash Algorithm** from the dropdown.
4. In the **Renewal Period (%)** field, enter a percentage. Edge Infrastructure Services starts renewing the certificate after this percentage of its validity period has elapsed. For example, entering **50** triggers renewal when 50% of the certificate's lifetime has passed. Coordinate this value with your CA administrator based on certificate validity length and expected device offline periods.
5. Click **Create Profile**.

## Enable 802.1x in the Project Node Policy

### On a new project

The Policies step is available for **Standard** and **Deployment** project types. Azure IoT projects do not include a Policies step; use the existing project flow instead.

1. Open **Infrastructure > Fleet > Projects**.
2. Click the **Add** button (floating button in the lower right of the page).
3. Select **Standard** or **Deployment** as the project type.
4. Complete the **Identity** step and click **Next**.
5. On the **Policies** step, locate the **Node Policy** card and enable its toggle.
6. Inside the Node Policy card, toggle on **802.1X Port-Based Network Access Control**.
7. The **EAP Method** field shows **TLS** and cannot be changed. TLS is the only supported method for this release.
8. In the **EAP Identity** field, enter an optional identity string to send during the EAP handshake. If left blank, EVE-OS uses the device certificate identity.
9. From the **Certificate Enrollment Profile** dropdown, select the profile you created.
10. Click **Next** to proceed to the Review step, then click **Create Project**.

### On an existing project

1. Open **Infrastructure > Fleet > Projects**.
2. Click the name of the project you want to configure.
3. Click the **Configure** (gear) button in the upper right of the page.
4. Click the **Policies** tab.
5. Click **Node Policy**.
6. Toggle on **802.1X Port-Based Network Access Control**.
7. The **EAP Method** field shows **TLS** and cannot be changed. TLS is the only supported method for this release.
8. In the **EAP Identity** field, enter an optional identity string to send during the EAP handshake. If left blank, EVE-OS uses the device certificate identity.
9. From the **Certificate Enrollment Profile** dropdown, select the profile you created.
10. Click **Save Changes**.

## Enable 802.1x on a New Node During Onboarding

1. Log into Edge Infrastructure Services.
2. Begin the standard node onboarding flow.
3. In the **Network Adapters** section, locate each adapter that connects to an 802.1x-protected switch port.
4. Enable the **Enable 802.1x** toggle for each of those adapter rows.
5. Set the **Interface Usage** for each adapter as appropriate.
6. Click **Save & Add** to complete onboarding.

## Enable 802.1x on an Existing Node

1. Log into Edge Infrastructure Services.
2. Open **Infrastructure > Fleet > Nodes**.
3. Click the name of the node you want to configure.
4. Click the **Adapters** tab.
5. Locate the adapter that connects to the 802.1x-protected switch port.
6. In the expanded adapter row, locate the **Enable 802.1x** toggle.
7. Toggle **Enable 802.1x** to enable it.
8. Repeat for any additional adapters.
9. Click **Save**.

## Verify the Configuration

On the **Nodes** list page, the **Certificate Status** column shows the enrollment state for each node. Expected status values include:

* **Valid**: The device has successfully obtained a certificate from the SCEP server and is authenticated to the network.
* **Pending**: The SCEP server returned a pending status, meaning the certificate request requires manual approval.
* **Enrollment Failed**: The enrollment request was submitted but the SCEP server returned a failure.
* **Renewal Failed**: The most recent renewal attempt failed. The existing certificate may still be valid and active.
* **Renewal Pending**: A renewal request has been submitted and is awaiting completion.
* **Expired**: The certificate's validity period has ended.
* **Invalid Configuration**: The certificate configuration is malformed or missing required fields.

If **Certificate Status** shows **Enrollment Failed**, verify that the SCEP server URL is reachable from the bootstrap VLAN and that the challenge password is correct.

If the **Enable 802.1x** toggle is unavailable on an adapter, confirm that **Enable 802.1x** is toggled on in the project's Node Policy.

If the device appears stuck in the quarantine VLAN after certificate installation, verify that the RADIUS server is receiving the re-authentication request and that the certificate's DN or SAN matches the policy configured on the PNAC backend.

## Next Steps

> [card] [802.1x Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/networks/802-1x-overview.md)
>
> Background on the authentication workflow and certificate bootstrapping model.

> [card] [Networks Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/networks-overview.md)
>
> An overview of node connectivity.