Skip to content

Introduction to EasyRadius

Welcome to EasyRadius, a robust SaaS RADIUS authentication service designed for EAP-TLS client certificate authentication.

What is EasyRadius?

EasyRadius is an Azure-based SaaS RADIUS service that provides:

  • EAP-TLS authentication using client certificates
  • Supports easy integration with the EasyScep Certificate Authority
  • Support for any CA with a public OCSP responder, including Microsoft Cloud PKI
  • High availability options across multiple regions
  • Simple configuration for both wired and wireless setups

Target Audience

EasyRadius is ideal for organizations that:

  • Want to secure enterprise Wi-Fi or LAN access using EAP-TLS (certificate-based authentication)
  • Are already using or planning to use Microsoft Intune for device management
  • Need a cloud-hosted RADIUS server without the overhead of managing on-premises infrastructure
  • Want to replace pre-shared key (PSK) Wi-Fi with stronger, per-device certificate authentication

System Requirements

Network Requirements

  • Firewall access to RADIUS service - IP and ports available after subscription setup
  • Outbound access from EasyRadius instances to your CA's OCSP responder
  • Network equipment supporting RADIUS authentication

Supported Authentication Methods

  • EAP-TLS (certificate-based authentication)

Key Features

High Availability

  • Multi-region deployment options
  • Automatic failover capabilities
  • Load balancing across regions

Security

  • Strong certificate-based authentication
  • Real-time certificate validation and revocation checking via OCSP

Management

  • Web-based administration portal
  • Detailed authentication logs

Certificate revocation checking

EasyRadius checks client certificate revocation in real time using OCSP (Online Certificate Status Protocol). The responder URL is read from the client certificate's Authority Information Access (AIA) extension, so your CA must publish an OCSP responder that is reachable from your EasyRadius instance.

Two behaviours are worth knowing before you onboard a CA:

  • Revocation checking is enabled, and a failed check rejects the authentication. If the responder is unreachable or returns an error, EasyRadius rejects the authentication rather than letting it through. An OCSP responder outage therefore stops authentication, so plan for its availability as you would for the RADIUS service itself.
  • OCSP nonces are sent by default. Some responders — including Microsoft AD CS in its default configuration — do not support nonces and will fail the check. If your CA is one of them, contact support so nonces can be disabled for your instance.

ℹ Per-subscription control of these two settings (OCSP on/off and nonces on/off) is rolling out now. Instances running a current EasyRadius image can change them under System Settings in the administration portal; instances running an older or custom image have both enabled and cannot change them. Contact support@just-software.com if you are unsure which applies to your instance.

CRL checking is planned and is not available today. EasyRadius does not download or consult Certificate Revocation Lists — all revocation checking goes through OCSP. If your CA publishes only a CRL and has no OCSP responder, contact support before onboarding it.

Pricing

EasyRadius is available as a monthly or yearly subscription through the Azure Marketplace. Visit the EasyRadius Azure Marketplace listing for current pricing and plan options.

Getting Started

  1. On-boarding Guide - Start here to set up your EasyRadius instance
  2. Configure your first RADIUS client:
  3. Add client definition in portal
  4. Configure shared secret
  5. Set up network equipment
  6. Test authentication with a client certificate

Administration Portal

Access the EasyRadius administration portal at https://portal.just-software.com

The portal allows you to: - Configure RADIUS clients / shared secrets - View authentication logs

Works great with EasyScep

EasyRadius works seamlessly alongside EasyScep, our SaaS Certificate Authority. Use EasyScep to issue and manage client certificates via Microsoft Intune, and EasyRadius to authenticate those certificates for Wi-Fi and LAN access via EAP-TLS — a complete, cloud-native certificate-based network authentication solution.

Support

For technical support or questions, contact us at support@just-software.com