Skip to main content

Device configurations

This document contains device configuration notes and settings for administrators to use about how to connect specific operating systems to a Wi-Fi network using their EAP-Join Dashboard. With proper configurations users will connect elegantly and without issues.

Android​

Root Certificate Authority (CA) certificate requirements​

For Android 11+ a security change makes it so the root CA certificate is required for 802.1X network trust.

Simply add this certificate into the EAP-Join Dashboard and it will be installed on every Android connecting device as required. This ensures proper certificate chain validation for enterprise Wi-Fi authentication with the latest Android security standards.

EAP-TLS configuration​

EAP-TLS provides the highest level of security using mutual certificate-based authentication. Here is an example how to configure EAP-TLS with EAP-Join.

This example uses OpenSSL to generate the certificates. We recommend to use a PKI (Public Key Infrastructure) for certificate management in production.

Creating the Client Certificate (.p12 file)​

To create the client.p12 file, it must not have a password. Use the following OpenSSL command:

openssl pkcs12 -export -in /path/to/client.crt -inkey /path/to/client.key -certfile /path/to/ca.pem -out /path/to/client-nopass.p12 -passout pass:

This will generate a client-nopass.p12 TLS identity certificate.

Android .p12 compatibility fix​

To make the certificate work properly on Android, an additional conversion step is required for proper PKCS#12 certificate handling:

Step 1: Convert the password-less P12 file:

openssl pkcs12 -nodes < client-nopass.p12 > /tmp/client-nopass-bag.pem

Step 2: Re-export with legacy mode for Android compatibility:

openssl pkcs12 -export -legacy -in /tmp/client-nopass-bag.pem > /tmp/client-nopass-legacy.p12

Note: This addresses the issue described in Stack Overflow regarding Android's PKCS#12 certificate handling. From our experience this -legacy export was necessary to complete in order for the .p12 to install properly on Android.

client-nopass-legacy.p12 can be uploaded to the EAP-Join Dashboard as your identity certificate for EAP-TLS.

During RADIUS events the .p12 identity can be viewed on the network. Use this identity to assign specific VLANs and/or Network Access Control (NAC) policies within your enterprise network.

EAP-Join Dashboard configuration​

Coming soon...

Common issues​

Certificate not trusted​

To resolve, verify:

  • The CA certificate is properly signed by a publicly trusted root CA
  • The certificate chain is complete and includes all intermediate certificates
  • Your Android device is running Android 10 or later for best compatibility

EAP-TLS authentication failures​

To resolve, verify:

  • The client certificate was created without a password (empty passphrase)
  • The legacy .p12 conversion steps were completed for Android compatibility
  • The certificate and private key match the same identity
  • The RADIUS server has been configured to accept the TLS certificates

iOS/iPadOS​

Coming soon...

macOS​

Coming soon...

Windows​

Coming soon...