Editing Extensible Authentication Protocol (section)

=== Tunnel Extensible Authentication Protocol (TEAP) ===
Tunnel Extensible Authentication Protocol (TEAP; {{IETF RFC|7170}}) is a tunnel-based EAP method that enables secure communication between a peer and a server by using the Transport Layer Security (TLS) protocol to establish a mutually authenticated tunnel. Within the tunnel, TLV (Type-Length-Value) objects are used to convey authentication-related data between the EAP peer and the EAP server.

In addition to peer authentication, TEAP allows the peer to ask the server for a certificate by sending a request in [[Certificate signing request|PKCS#10]] format. After receiving the certificate request and authenticating the peer, the server can provision a certificate to the peer in PKCS#7 format ({{IETF RFC|2325}}). The server can also distribute trusted root certificates to the peer in PKCS#7 format ({{IETF RFC|2325}}). Both operations are enclosed into the corresponding TLVs and happen securely within the already established TLS tunnel.