How-To: Issue Server Certificates in Keytos Shield on Keytos Docs

How-To: Create a RadSec Client Certificate in Keytos Shield

Tue, 29 Sep 2026 09:00:00 -0400

Overview - What is a RadSec Client Certificate?

When a network access point or switch connects to Keytos Shield via RadSec (RADIUS over TLS), it needs to present a client certificate that Keytos Shield can trust and validate. Some network devices, such as Cisco Meraki, use a certificate issued by the vendor’s own CA. However, for other network devices such as Unifi, you will need to install a RadSec client certificate that you created in Keytos Shield. This guide will go over creating a RadSec client certificate in Keytos Shield for RadSec authentication with your network controller.

How-To: Create a Domain Controller Certificate in Keytos Shield

Tue, 29 Sep 2026 09:00:00 -0400

Step-by-Step Guide - How to Issue Domain Controller Certificates in Keytos Shield

Follow these steps to create and issue domain controller certificates in Keytos Shield.

Prerequisites for Creating Domain Controller Certificates in Keytos Shield

Before you begin creating domain controller certificates in Keytos Shield, ensure that you have completed all the necessary prerequisites:

The Keytos Entra ID applications are registered in your tenant.
You have signed up for a Keytos Shield Plan.
You are a Subscription Owner or Network Administrator.
You have completed the Keytos Shield Network Security onboarding
- Make sure you selected Hybrid infrastructure for What type of environment do you have? during onboarding.
You have pushed your CA certificates to your Intune devices

Step 1 - How to Trust Your Keytos Shield CA Certificates in Active Directory

The first step is to add the Keytos Shield CA certificates to the NTAuth Store. This will enable the certificate to be used for authentication in Active Directory.

How-To: Issue a Server Certificate in Keytos Shield

Tue, 29 Sep 2026 09:00:00 -0400

Looking to issue client certificates to your users and devices?

Check out our guides for distributing client certificates via your Mobile Device Management (MDM) platform.

What Is a Server Certificate in Keytos Shield?

A server certificate is issued by Shield’s certificate authority (CA), with custom subject, names, lifetime and usages that you determine. This is most useful for anything that needs to trust Shield in your network: servers, appliances, domain controllers, or devices that don’t fit the built-in RadSec flow.