{"wiki":"en","slug":"portauthentifizierung-eap-tls","markdown":"<tags data-tags=\"Network;Email;Setup guides;\" />\n\n# Port Authentication 802.1x via EAP-TLS\n\nThis setup guide describes how to configure port authentication 802.1x via EAP-TLS in the Behnke Station.\n\nIt should be noted that the intercom station must have its time synchronized so that authentication can proceed smoothly. This can be achieved, for example, by first connecting the Behnke Station without port authentication to a network with a DHCP server.\n \n%[NOTE_REQUIRES_BASIC_SETUP](NOTE_REQUIRES_BASIC_SETUP)%\n\n<!-- block: konfiguration-der-behnke-station -->\n## 1. Configuring the Behnke Station\n\n- Open your browser\n- Open the web interface of the Behnke Station\n- Log in\n\n\n![Behnke Station, web interface, login](uploads/1925d7531d6421acb8156ce496dbd635/Mail_Versand_01.png)\n\n\n- Click the menu item %BS_MENU_NETZWERK% in the sidebar\n- Scroll down to the section **Port authentication**\n- Set the first option **Method** to the value **EAP-TLS**\n- The input fields required for further configuration are now displayed\n\n- The first setting determines whether authentication is mandatory or optional. If it is set to mandatory, as in the default, the Behnke Station must authenticate itself to the RADIUS server in order to make the network available.\nIf port authentication is switched off or the Behnke Station is operated on another port without an authentication request, the network cannot be established for security reasons:\n\n![image](uploads/c8c4d770f69fc6d7de8a181c3a26ec74/image.png)\n\n- Then fill in the **Identity** field with the value you assigned when creating the certificates.\n\n- Upload the **User certificate** and the certificate of the **Trusted CA** using the two buttons provided for each.\n\n- If a private key (client.key) is uploaded and the password for decrypting it is entered, the Behnke Station checks this immediately and displays the result in the web front end, as shown below:\n\n![image](uploads/cd92902c4d34963f4c48f07a7da36b7a/image.png)\n\nIt should also be mentioned that the certificates are checked for validity immediately after upload. Below is an example of what is shown if, for instance, the validity period is not valid.\nThe identities are also displayed immediately in the web front end (in the example user@example.org and the Example Certificate Authority):\n\n![image](uploads/24965a0764dbb9c3920d9c626dd66715/image.png)\n\nFinally, attention should be paid to the formats: for the user certificate, .pem or .crt files are valid, the trusted CA must be in .pem format, and the private key must be in .key or .pem format.\n\n<!-- block: faq -->\n## 2. FAQ\n\n%[NO_CONTENT](NO_CONTENT)%\n","lastModified":"2026-10-14T13:47:15+02:00"}