Your 802.1X SSID admits handsets you do not manage — how do you assure their certificate settings?

## Why this is a measurement problem, not a configuration problem Every other part of an admission design is verifiable from your side. You can prove a port speaks only EAPOL before authentication. You can prove a RADIUS policy denies. You cannot prove that a handset checked your server's certificate, because the check happens inside the client and produces no observable difference on the wire when it succeeds. A device with validation off and a device with validation on look identical when they connect to the real server. They differ only in the presence of an attacker — which is to say, you learn the answer at the worst possible moment unless you go and produce it yourself. On a retail branch estate plus a shared multi-tenant floor, the fleet is not one fleet. Corporate laptops take a managed profile. Store tablets were provisioned three vendors ago. Staff-owned handsets joined the SSID because someone read the name off a poster and typed a password. The last group is the one that matters and the one you have no reach into. ## Move one: make provisioning the only door If the SSID can be joined by typing a name and a credential, some fraction of the estate will always be unvalidated. The countermeasure is procedural: publish the network only as a configuration profile that carries the trusted CA and the expected server name, and never publish manual instructions. This does not fix devices already joined, and it is the step people skip because manual instructions are what the helpdesk has always sent. ## Move two: measure it with a decoy you own The only way to count unvalidated devices is to be, briefly and legitimately, the thing they fail to check. With written authorisation from someone empowered to give it, and scoped tightly — your own premises, your own SSID name, a fixed window, minimal power, and no capture or retention of anything a device sends beyond the fact that it proceeded — announce your SSID from a controlled radio presenting a certificate that no correctly configured profile would accept. A device with a correct profile aborts. A device without one proceeds. Count them; do not keep what they send. The result is per site and per platform, and it is a *floor*, not a total: it tells you about devices present, in range, awake and roaming during the window. Repeat it on a cadence rather than treating it as a one-off audit, because the fleet churns. The cost is real and it is mostly not technical: obtaining the authorisation, agreeing the handling rules with whoever owns privacy and employment questions, briefing site staff so a store manager does not report it as an incident, and finding a window that is not a trading peak. On a shared floor there is an additional constraint — keep transmit power low enough that you are not soliciting a neighbouring tenant's devices, because your authorisation does not cover them. ## Move three: write down what you do not cover The deliverable a wireless engineer owes here is unusually blunt, because the control's coverage is a property of somebody else's fleet. It should state: the number of devices on the SSID, the number provisioned by us with a pinned anchor and server name, the measured proceed-rate from the last decoy run, the exception register of device types that cannot take a profile and what they were given instead, and one sentence saying that for everything outside the first number, 802.1X authenticates the device to us and nothing authenticates us to the device. That statement goes to the fleet owner — often a retail operations or IT function that does not report to you. You will not always get the budget or the mandate to fix it. The point of writing it is that the residual risk is then held by someone who can decide about it, rather than silently by you. ## Wrong answers worth pushing on *We will check it in the onboarding portal* — the portal sees a browser, not the supplicant profile. *RADIUS will show it* — RADIUS sees a completed authentication and cannot distinguish a validated one. *We will mandate it in policy* — a policy statement is not a measurement, and this is a control whose only honest metric is a count. *We will just block unmanaged devices* — that is a different design decision with its own owner and its own cost, and if you could have made it you would not be in this conversation.