HPE7-A02 Exam - Topic 9 Question 37 Discussion

For a ClearPass RADIUS/EAP server certificate, the certificate identity should clearly represent the ClearPass server or service name that supplicants validate during 802.1X authentication. A fully qualified domain name in the subject common name, without a wildcard, is the safest guideline because it provides a specific and predictable server identity. Wildcard identities are not preferred for EAP server identity validation because they weaken specificity and can create trust ambiguity. A private CA is acceptable in enterprise 802.1X if clients trust its root certificate. RSA versus EC is a compatibility and policy decision, not simply a way to obtain shorter keys. A SAN may include DNS names, but requiring an IP address is not the best general guideline.

===============