Matt, a systems security engineer, is determining which credential-type authentication to use within a planned 802.1x deployment. He is looking for a method that does not require a client…

EAP-TLS requires both a server-side certificate and a client-side certificate for mutual authentication, which violates the requirement of no client certificate.

EAP-FAST uses a Protected Access Credential (PAC) file for tunnel establishment rather than a server-side certificate, so it does not match the server certificate requirement.

PEAP-CHAP is not a valid or standardized 802.1x inner authentication method; MSCHAPv2 is the correct and supported inner method used with PEAP.

PEAP (Protected Extensible Authentication Protocol) uses a server-side X.509 certificate to establish an outer TLS tunnel, which encrypts the inner authentication exchange. Inside that tunnel, MSCHAPv2 authenticates the client using username and password credentials, so no client certificate is required. This combination is the most widely deployed 802.1x credential-based method that meets all three stated requirements.