Connect. Secure. Manage.
Access Manager Certificate Authentication
Design certificate-based access with Cisco Access Manager, covering trust chains, identity mapping and certificate provisioning dependencies.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Access Manager certificate authentication uses digital credentials to check who or what is joining the network. It can replace a shared Wi-Fi password in a supported design. We plan how certificates are issued, renewed and withdrawn with your endpoint team. Tests cover both trust in the credential and the access granted after it is accepted.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Decide whether the identity is a user or a device
A device credential can establish that an approved machine holds a certificate, while a user credential may support a person-specific access decision. We agree which identity the network needs at each point, including startup before user login and shared-device scenarios. The choice determines the certificate profile and the attributes available to Access Manager policy.
Additional identity lookups are treated as separate dependencies. Where a supported Entra ID user lookup is required, we check how the certificate identity maps to that user and which group information can be used. We do not assume that every machine credential maps to a user or that a certificate alone establishes current device compliance.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Build a controlled trust model
We find the certificate authorities and chains that Access Manager should trust and the credentials that endpoints should accept from the authentication service. The scope of trust is deliberate. Importing a broad issuing hierarchy without considering what else it signs can make it harder to distinguish network-access credentials from unrelated certificates.
Client profiles should check the intended service rather than invite users to accept unexpected certificate prompts. We coordinate trusted issuers, server identity settings and EAP setup with the endpoint team. The pilot includes an inappropriate credential or trust condition so that the design proves rejection and successful access.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Establish enrolment and private-key handling
Devices need a way to get the credential before ordinary network access is granted. We document the enrolment service, required network access and the admin process for a new or rebuilt endpoint. A certificate design is incomplete when onboarding relies on the unrestricted access that the certificate is meant to control.
Private keys are handled as sensitive credentials. We review how they are generated, stored and protected under the customer's endpoint platform, with ownership assigned to the appropriate team. The rollout does not distribute reusable private keys casually between devices or include them in handover documents. Network engineers need the trust and profile needs, not unrestricted access to every endpoint's secret material.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Translate certificate attributes into permissions
A certificate accepted by a trusted chain should receive only the access intended for its identity. We set out the relevant attribute conditions and the supported authorisation result. The rules distinguish legitimate classes of endpoint and include a deliberate result for an otherwise valid credential that does not match the approved population.
We then test enforcement at the access point or switch and beyond it. Required VLANs, addressing and firewall boundaries must agree with the Access Manager result. A successful EAP-TLS exchange is not the finish line if the device reaches an unintended network or cannot access its legitimate business service.
Plan renewal, revocation and replacement
The service needs a process for routine renewal and for replacing a lost, rebuilt or compromised endpoint. We check the supported revocation and validation behaviour of the chosen workflow, including dependencies and any limitations. The operating procedure explains how to withdraw access urgently and what happens to a current session.
Trust-chain changes require their own plan. We test a controlled overlap and removal sequence where appropriate so that a certificate authority transition does not disconnect every managed device at once. Devices that have been offline for a long period need a practical recovery route, not an instruction to renew through a network they can no longer join.
Test the everyday operating events
The pilot covers first enrolment, reboot, sleep, user changes, certificate expiry and a renewed credential on representative operating systems. We also check policy behaviour when an optional identity lookup is unavailable. These events expose issues that a single successful connection on an engineer's laptop cannot resolve.
Evidence is recorded without retaining private keys or unnecessary personal information. The report names the device and software combinations actually tested and identifies any unsupported or unverified cases. That gives the service desk a useful basis for support instead of a general claim that certificate authentication works everywhere.
Put lifecycle ownership into the handover
MCI supplies the trust design, access-rule mapping, endpoint prerequisites and working procedures. Certificate issuance, renewal monitoring and identity-group maintenance remain assigned to named owners. This work can accompany Cisco Access Manager rollout or replace a current shared-credential arrangement, with acceptance tied to the customer's actual access needs rather than the completion of a dashboard setup.
Technical references
- EAP-TLS with Entra ID lookup — Cisco / Cisco Meraki
- EAP-TTLS/PAP with Entra ID lookup — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.