You are establishing a cluster of HPE Aruba Networking ClearPass servers. (Assume that they are running version 6.9.). For which type of certificate is it recommended to install a CA-signed certificate on the Subscriber before it joins the cluster?

The process of a Subscriber node joining a Publisher in a ClearPass cluster relies on secure management communication between the two nodes. This communication, which includes API calls and configuration synchronization, occurs over HTTPS. To ensure the Publisher can validate the identity of the Subscriber and establish a trusted connection during the "add subscriber" operation, it is a best practice to install a CA-signed HTTPS certificate on the Subscriber before initiating the join process. This prevents certificate trust errors that could otherwise interrupt the cluster formation.

B. Database: The Publisher's database certificate is automatically pushed to the Subscriber during the join process, overwriting any existing certificate on the Subscriber.
C. RADIUS/EAP: This certificate is used for authenticating clients (supplicants) during 802.1X authentication and is not used for the inter-server management communication that establishes the cluster.
D. RadSec: This certificate is specifically for securing RADIUS traffic between ClearPass and network devices (like controllers or switches), not for the initial cluster setup communication.

1. Aruba ClearPass Policy Manager 6.9 Deployment Guide: In the chapter on "Clustering and High Availability," the section "Adding a Subscriber Node" states, "Aruba recommends that you install a new server certificate for the HTTPS and RADIUS server on each ClearPass node." The HTTPS certificate is critical for the management plane communication required to add the node to the cluster. (Page 63)

2. Aruba ClearPass Policy Manager 6.9 User Guide: The section "Managing Server Certificates" describes the HTTPS (SSL/TLS) certificate's role for securing communication to the administrative user interface, captive portal, and API interfaces. The cluster join process utilizes these secure administrative interfaces for inter-node communication. (Chapter "Administration > Server Manager > Server Configuration > Certificates")