EAP-PEAP is the most suitable 802.1X-based authentication method for environments that do not have a public key infrastructure (PKI). It uses a server-side certificate but does not require client-side certificates, simplifying deployment while maintaining strong authentication.

From CWDP-305:

“EAP-PEAP allows secure authentication using usernames and passwords without requiring client certificates, making it ideal for organizations lacking PKI infrastructure.”

Other options:

EAP-TLS requires a PKI and client certificates (not suitable here).

PSK (pre-shared key) options don’t use 802.1X.

TKIP/RC4 is deprecated and insecure.

— Reference: CWDP-305 Official Study and Reference Guide, Chapter on Wireless Design Process