You need to set up HPE Aruba Networking ClearPass Policy Manager (CPPM) to provide certificate- based authentication of 802.1X supplicants. How should you upload the root CA certificate for the supplicants' certificates?

For HPE Aruba Networking ClearPass Policy Manager (CPPM) to perform certificate-based 802.1X authentication (such as EAP-TLS), it must be able to validate the certificate presented by the supplicant (client device). This validation process requires CPPM to trust the Certificate Authority (CA) that issued the supplicant's certificate. To establish this trust, the root CA certificate must be uploaded to the CPPM's Trust List. The certificate's "Usage" must be explicitly enabled for "EAP" to allow the RADIUS server component to use it for validating client certificates during EAP authentication exchanges.

A. As a ClearPass Server certificate with the RADIUS/EAP usage: A ClearPass Server certificate is used to prove the identity of the CPPM server to clients, not to validate client certificates.
B. As a Trusted CA with the AD/LDAP usage: The AD/LDAP usage is for securing communications with directory services (LDAPS), not for validating supplicant certificates in an 802.1X context.
D. As a ClearPass Server certificate with the Database usage: This refers to the server's own identity certificate, and the "Database" usage is for securing connections to an external SQL database.

1. HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide, Page 1, "Certificates > Certificate Store" section. The guide states, "The Trust List contains the list of Certificate Authorities (CAs) that are trusted by the ClearPass server. When a client presents a certificate to the ClearPass server, the server checks if the certificate is signed by one of the CAs in the Trust List." (Document Published: December 2022).

2. HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide, Page 1, "Certificates > Trust List > Adding a Certificate to the Trust List" section. Step 5 of the procedure describes enabling the certificate for specific services: "To enable the certificate for a service, select the corresponding check box in the Usage column. Options are: EAP, RadSec, Aruba Infrastructure, Others, AD/LDAP, Database." This confirms that "EAP" is the correct usage for this scenario. (Document Published: December 2022).

3. Aruba ClearPass Essentials, Rev. 20.41, Student Guide, Module 6: "Certificates". The guide explains that for EAP-TLS, the CA certificate that signed the client certificates must be imported into the ClearPass Trust List and the EAP usage must be enabled. This is distinct from the RADIUS/EAP Server Certificate, which is used for server authentication. (See sections on "Trust List" and "EAP-TLS Configuration").