802.1X is the IEEE standard for network access control: a device has to prove who it is before a switch port or Wi-Fi network lets it on. On networks that require it, a signage player that can't do 802.1X either stays off the network or needs an exception, and exceptions are what security teams try to avoid.
How it works
Three parts take part. The device (the supplicant) asks to join. The switch or wireless access point (the authenticator) holds the port closed. An authentication server, usually RADIUS, checks the device's credentials and tells the port to open. The conversation between them uses EAP, and the EAP method decides what the device has to show.
PEAP and EAP-TLS
| Method | The device proves itself with | Note |
|---|---|---|
| PEAP | A username and password, inside an encrypted tunnel | Common and easy to set up; the password is shared by every device that uses it |
| EAP-TLS | Its own certificate | Each device has its own identity; security teams prefer it |
Why signage struggles with it
A laptop has a person to type a password and a management tool to install a certificate. A player behind a screen has neither. Many networks fall back to MAC authentication bypass for such devices, letting a port open for a known hardware address, which anyone who copies the address can get through. That fallback is exactly what an 802.1X policy is meant to remove.
What to ask a signage vendor
- Does the device support 802.1X over both Wi-Fi and Ethernet?
- Which EAP methods: PEAP, EAP-TLS, or both?
- How are credentials or certificates put on the device, and can that be done remotely?
- Where are the credentials stored on the device?
- What happens when a certificate expires?
Where Screenly stands
ScreenlyOS devices join 802.1X networks with PEAP over Wi-Fi and Ethernet. Certificate-based 802.1X (EAP-TLS) is not supported yet. Where a network needs certificates, the alternative is a separate network segment for the screens, which connect outbound only. Network security covers the rest.
