The scenario requires the Certificate Authority (CA) certificate to be trusted for two distinct purposes. First, for validating the certificates presented by domain users and computers during 802.1X authentication, the EAP (Extensible Authentication Protocol) usage is necessary. This allows ClearPass to act as a RADIUS server and validate the client's certificate chain in EAP-TLS or PEAP-EAP-TLS.

Second, the requirement for encrypted communication between ClearPass and the domain controllers for account lookups implies the use of LDAPS (LDAP over SSL/TLS). For ClearPass to establish a secure LDAPS session, it must trust the server certificate presented by the domain controller. Enabling the AD/LDAP Server usage for the imported root CA certificate allows ClearPass to validate the domain controller's certificate.

A. Radec and Aruba infrastructure: Radsec is for secure RADIUS-to-RADIUS communication, and Aruba Infrastructure is for device management; neither is relevant for client authentication or AD lookups in this context.

C. EAP and Radsec: Radsec is incorrect. The encrypted communication is with an Active Directory domain controller (which uses LDAPS), not another RADIUS server.

D. LDAP and Aruba infrastructure: The Aruba Infrastructure usage is not required. While AD/LDAP Server usage is correct, this option pairs it with an incorrect one.

1. HPE Aruba ClearPass Policy Manager 6.9 User Guide

Page 288

"Trust List Page". This section details the certificate usages.

EAP: "Select this check box to use this certificate for EAP." This directly supports the requirement to validate client certificates.

AD/LDAP Server: "Select this check box to use this certificate for AD/LDAP Server." This supports the requirement to trust the domain controller's certificate for a secure connection.

Radsec: "Select this check box to use this certificate for Radsec." This defines Radsec for secure RADIUS proxying

which is not the scenario described.

2. HPE Aruba ClearPass Policy Manager 6.9 User Guide

Page 111

"Adding Active Directory Authentication Sources". This section describes the "Connection Security" setting for an AD authentication source.

To meet the requirement for encrypted communication

the "AD over SSL" option would be selected

which uses port 636 (LDAPS). The guide states

"To use this option

the root CA of the AD server certificate must be available in the Certificate Trust List." This confirms the need for the AD/LDAP Server usage.