.webp)
Introduction
Enterprises are retiring passwords for network access and moving to certificate-based authentication. That shift forces a decision about who runs the certificates. The answer shapes your security posture, your operational load, and how fast you can scale to new sites.
You can run your own public key infrastructure (PKI), meaning a certificate authority (CA) and an enrollment pipeline, plus a separate RADIUS layer. Or you can consume PKI as part of a Cloud network access control (NAC) platform. The bolt-on path looks flexible, but it spreads certificate operations across systems that drift, expire, and fail.
This article makes a clear case. PKI built into a unified Cloud NAC platform beats bolt-on certificate services on security, operations, and scale. Below are the mechanics and a checklist to evaluate the choice.
What PKI and certificate-based access control actually do
PKI binds a cryptographic key to a verified identity. Futurex explains that PKI uses digital certificates and certificate authorities (CAs) to support authentication, encryption, and governed certificate lifecycles.
Trust flows through a chain. A root CA vouches for issuing CAs, which in turn vouch for device and user certificates. If the chain is intact, any system on the network can verify an identity without a shared password database.
A CA issues each certificate, and the certificate, backed by its private key, proves the holder's identity. On the network, certificates authenticate devices and users through 802.1X, the port-based access-control standard. Microsoft documents 802.1X using the Extensible Authentication Protocol (EAP) and a RADIUS server to validate each certificate. Certificate-based access uses the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) method, defined in IETF RFC 5216 for certificate-based mutual authentication.
Revocation is part of the lifecycle too. When a device is lost or an employee leaves, the CA marks that certificate invalid so the network stops trusting it. In a bolt-on setup, every RADIUS server must be configured to check revocation, and cached revocation lists can delay it.
Microsoft also notes that a certificate authority infrastructure is itself a public key infrastructure. That is the same PKI an enterprise would otherwise run on its own. The only question is who carries the operational weight.
Certificates beat passwords because there is no shared secret to phish or reuse. A private key stays on the device, so stolen passwords stop being a way in. But certificates are not set-and-forget, because an expired or unmanaged certificate becomes its own failure point.
Picture a laptop joining the corporate Wi-Fi. With a certificate, the device presents cryptographic proof of identity, and the network checks it before granting access. No one types a password, and no credential travels the air to be captured.
This matters for Zero Trust. NIST SP 800-207 defines a Zero Trust architecture that replaces implicit network-location trust with explicit, per-request decisions about users and devices.
Certificate-based access gives Zero Trust a verifiable identity to check on every request. Still, PKI is a trust mechanism within that architecture, not the architecture itself. It works alongside identity and access management (IAM), multi-factor authentication (MFA), and continuous evaluation.
Per-request checks only work if the identity is trustworthy. A certificate issued and governed by PKI gives that identity cryptographic weight. That is why Zero Trust designs lean on it rather than on passwords.
The market reflects the shift. Grand View Research estimates the global PKI market at USD 6.37 billion in 2024, rising to a projected USD 19.65 billion by 2030.
Certificates are already mainstream on the network itself. Mordor Intelligence reports 802.1X led 2024 NAC authentication at 60.1%, and names cloud the fastest-growing deployment model at a 25.2% CAGR through 2030.
The bolt-on problem: the real cost of separate PKI
Running PKI as a bolt-on means assembling systems that were never designed as one. A standalone CA issues certificates, a separate RADIUS layer authenticates sessions, and an enrollment pipeline pushes certificates to devices.
Each piece has its own owner, console, and failure mode. That fragmentation carries a measurable cost.
A 2025 CyberArk survey of 1,200 security leaders found 72% had a certificate-related outage in the past 12 months.
The operational cost is hidden. Every console is another login, patch cycle, and on-call rotation. When a certificate expires at an odd hour, the team that owns renewal may not be the team that fields the outage.
Consider a retailer with 400 stores. If each site runs its own RADIUS and renewal scripts, one lapsed certificate can knock a store's registers offline. The fix is a quick reissue, but finding the right owner and console is the slow part.
Multiply that by every certificate in the estate. A mid-size enterprise can hold thousands, each with its own expiry date and owner. Tracking them by hand is where bolt-on models quietly fall behind.
The top failure points of the bolt-on model are consistent:
- Expired certificates that no one renewed, because ownership was split across teams.
- Policy drift between sites, where each location runs its own RADIUS and rules.
- Manual renewal that cannot keep pace as certificate lifespans shrink.
- Scarce expertise, because 802.1X and certificate skills are hard to hire.
- Scattered logs that make audit evidence slow to assemble.
Shrinking lifespans add pressure. The CA/Browser Forum has already voted to cut public TLS certificate validity to 47 days by 2029. Private 802.1X certificates are not bound by that rule, but the industry is clearly moving to shorter lifespans and automated renewal, a pace that manual, bolt-on renewal cannot match.
Visibility fragments too. When certificates spread across clouds, regions, and on-premises systems, keeping a central view gets hard. You cannot renew or revoke what you cannot see.
Fragmentation also slows audits. When logs live in several consoles, assembling evidence for a review takes days of manual export and reconciliation. A single pipeline turns that work into a standing report.
Legacy stacks add hardware. The most-cited 802.1X guidance still assumes an on-premises Windows Server and RADIUS model you must size, patch, and maintain. That is the legacy NAC approach cloud-native platforms replace.
Why PKI built into Cloud NAC changes the equation
A unified Cloud NAC platform folds the CA, authentication, and enrollment into one service. Cloudi-Fi unifies Cloud NAC with a Zero Trust Network Access (ZTNA) identity provider and runs its own PKI inside that platform.
The result is fewer systems to run and fewer seams where access quietly breaks. Each subsection below maps to a specific bolt-on failure the platform removes.
One identity pipeline instead of four moving parts
With built-in PKI, the platform issues, renews, revokes certificates, and enforces 802.1X in one place. There is no separate CA, RADIUS, and enrollment glue to break. Revocation is centralized, so a compromised device loses access across every site at its next authentication.
Because one system holds the full picture, an audit question becomes a query rather than a scavenger hunt across teams. The platform knows which certificate belongs to which device and when it expires.
No local RADIUS, no appliances
Cloud-delivered certificate authentication removes the hardware the legacy model needs. Cloudi-Fi's Cloud-ready 802.1X provides identity-based access without a local RADIUS server. For a multi-site enterprise, there is no appliance to ship, rack, and maintain at every branch.
New sites inherit certificate-based access as soon as they connect. Branch rollouts stop waiting on hardware procurement, which often sets the real timeline for a new location.
Automated certificate lifecycle
Automation closes the gap behind most outages. Cloudi-Fi issues Simple Certificate Enrollment Protocol (SCEP) certificates through Microsoft Intune and supports an external CA and the Cloudi-Fi CA as authentication providers.
Automatic enrollment, renewal, and revocation align with NIST SP 1800-16, which recommends formal certificate lifecycle management on inventory, monitoring, and automation. As certificate lifespans keep shrinking, that automation becomes a requirement, not a convenience.
The platform logs every issuance and revocation, so the certificate inventory stays current. No one has to reconstruct it from a spreadsheet during an incident.
One model for employees, BYOD, and IoT/OT
The same platform onboards managed laptops, bring-your-own-device (BYOD) phones, and Internet of Things and operational technology (IoT/OT) sensors. Certificates handle managed devices, while a captive portal and device fingerprinting handle the rest.
Unmanaged devices that cannot hold a certificate authenticate through the captive portal or are identified by device fingerprinting, so they are still covered by policy. Cloudi-Fi combines its captive portal, IoT Discovery, and Cloud DHCP to bring every device class under one identity model. A new device type means a new policy, not a new tool.
Infrastructure-agnostic and global by design
One platform integrates with existing network and security vendors through native APIs, so you keep your current Wi-Fi and security stack. Adopting certificate-based access does not mean ripping out switches, access points, or firewalls.
The platform spans wired, wireless, LTE, and satellite links, so one certificate policy follows a device however it connects. Cloudi-Fi's own platform data shows the model at scale: 100K+ secured sites across 90+ countries, serving 500M+ users and devices for 200+ enterprises. Data sovereignty is built into the architecture, so each region's data stays where regulation requires.
Built-in vs bolt-on: a decision checklist
The choice comes down to how many moving parts you want to own. The table below compares the two models across the dimensions that drive cost and risk.
Before choosing, ask your team a few questions:
- Who owns certificate renewals at 2 a.m. when one expires?
- How many consoles break if you change or rotate the CA?
- Can every site enforce the same access policy without local tuning?
- How quickly can you produce a full certificate inventory for an audit?
- How fast can you onboard a new device type or a new country?
The questions matter more than the feature list. A vendor demo rarely shows what happens at renewal time or during an audit. The answers reveal how much operational load actually moves off your team.
For most multi-site enterprises, the math favors consolidation. Fewer consoles mean fewer places for access to fail. One policy means every site behaves the same way.
Be honest about the trade-off. A unified platform depends on cloud connectivity and shifts trust to the provider. Weigh the provider's resilience, data-sovereignty controls, and integration fit against the operational load you remove.
Best practices and considerations for certificate-based Cloud NAC
Built-in PKI simplifies the work, but good practice still decides the outcome. These steps keep a certificate-based Cloud NAC deployment reliable and compliant. None are unique to one vendor, yet a unified platform makes each one easier to sustain.
- Automate the full certificate lifecycle so no certificate is left to expire unnoticed.
- Keep an authoritative inventory of every certificate and the identity it binds.
- Start with managed devices on 802.1X before extending to BYOD and IoT/OT.
- Treat PKI as one part of a Zero Trust strategy alongside IAM, MFA, and continuous evaluation.
- Map certificate controls to compliance needs without assuming PKI alone makes you compliant.
- Plan for data sovereignty across regions from day one.
These controls map to frameworks such as NIS2, HIPAA, and PCI DSS. PKI supports the strong authentication and encryption they require, but policy and governance still determine compliance. Treat the inventory and automation as foundations, and audits become a byproduct of daily operations.
Conclusion
Certificate-based access is the direction of travel, and the operational model now decides success. Bolt-on PKI spreads certificates across systems that drift and expire, which is why outages are so common. Built-in PKI in a unified Cloud NAC platform removes those seams.
Teams that consolidate certificate operations spend less time firefighting and more time on policy. The platform delivers consistent, automated, Zero Trust access across every site and device. If you are weighing the two models, see how Cloudi-Fi's Cloud NAC builds PKI in, and get a quote for your estate.
.webp)
