Skip to main content

iOS/iPadOS

iOS and iPadOS support both Passpoint (Hotspot 2.0) and non-Passpoint SSIDs for Wi-Fi connectivity. EAP-Join provides flexible installation methods depending on your network configuration requirements.

Supported on:​

  • iOS/iPadOS 18.6 or higher
  • An existing Wi-Fi network with:
    • EAP-TTLS
    • EAP-TLS
    • EAP-PEAP
    • EAP-FAST
    • WPA2 or WPA3
    • Passpoint (Hotspot2.0)
    • OpenRoaming
    • Pre-shared key (PSK) password

Installation methods​

There are two main ways to connect to EAP-Join Wi-Fi with iOS and iPadOS: invoke access on demand without the app installed by using the Apple App Clips or use the full app.

Apple App Clips​

Installing Wi-Fi configurations via the Apple App Clips is the fastest and easiest way to install Wi-Fi configurations because end users do not need to install any app on their device. The Apple App Clip can be invoked from the Wi-Fi Download Portal or from custom invocations at your physical locations such as NFC tag or App Clip code scanning.

Requirements​

  • Authentication that works for App Clips: EAP-PEAP, EAP-TTLS, PSK
  • For EAP-PEAP and EAP-TTLS: trusted server certificate by name (so full certificate doesn't need to be installed on device)
  • Use the EAP-Join setting "Skip CA certificate install in App Clips" to ensure App Clip mode works properly and skips trying to install the CA cert on devices.

Recommendation for Apple App Clip​

  • EAP-TTLS with a trusted server certificate name

Note: Certificates cannot be installed with Apple App Clips method. App Clips can only install Wi-Fi if your specific wireless infrastructure supports a configuration installing without requiring a full certificate to be installed. Self-signed Trusted Server certificates won't work with Apple App Clips because iOS/iPadOS does not trust self-signed certificates without install the full cert. Instead use an available root certificate for Apple operating systems in the chain of your trusted server certificate. EAP-Join recommends using LetsEncrypt to avoid this issue without purchasing an expense certificate!

Generate an App Clip code for NFC tag or camera code scanning​

Administrators can generate Apple App Clips codes for their own Wi-Fi invocation.

Note: Use the library from Apple for App Clip code generator to make your own personalized App Clip codes with the exact settings you need.

An example AppClipCodeGenerator code for an EAP-Join Wi-Fi configuration is:

sudo AppClipCodeGenerator generate --url 'appclip.eapjoin.com/w?id=123456789' --index 8 --output ~/Desktop/appclip-eapjoin-123456789.svg --type nfc --logo none

Full app​

The same app as App Clip, but allows certificates to be installed for EAP-TLS connectivity and other advanced configurations.

Requirements:

  • Full app installation from the Apple App Store required
  • Required for installing any certificates (including full CA chains)
  • Supports EAP-TLS with custom certificate authentication, and everything in the "Supported on" section above.

Important: To install any certificates, the full app is required. The App Clip cannot handle certificate installation.

Certificate trust requirements​

iOS/iPadOS supports publicly trusted Root CAs through the "trusted server name" feature Without a trusted certificate the full certificate needs to be installed which is also supported with EAP-Join but user needs the full iOS app installed (no App Clip support unless server certificate is trusted). For optimal compatibility with Apple App Clip support use a publicly trusted certificate:

Publicly trusted root CAs​

Only publicly trusted Root CAs can work with the "trusted server name" approach. The full CA cert needs to be installed (full app required) if the CA is not on Apple's trusted list:
https://support.apple.com/en-us/105116

Third-party CA signing​

The root CA must be signed by a trusted third-party CA to be properly trusted, so it can work with App Clip (and not need to be directly installed on device). For easiest guest Wi-Fi process, it is best to have a Trusted Server CA, so the App Clip can work with just a reference to the CA.

Warning: If a certificate has been issued from a CA whose root isn't in the list of trusted root certificates, iOS, iPadOS, or macOS won't trust the certificate.
Source: Apple Deployment Guide

Self-signed CAs​

If you use a self-signed CA, the cert will not be trusted. So it cannot work with only the "Trusted Server Name". For full trust and App Clip compatibility, obtain certificates from a publicly trusted Certificate Authority.

For detailed information on Apple's security trust requirements:
https://support.apple.com/en-us/103769

Troubleshooting​

Errors installing Wi-Fi through Apple App Clip​

Ensure your network is configured with PEAP or TTLS authentication and the "Skip CA certificate install in App Clips" setting is enabled.

Certificate trust issues​

If you're experiencing certificate trust warnings, verify that your Root CA is publicly trusted by Apple. Consider obtaining certificates from a well-known Certificate Authority listed on Apple's trusted root certificates page.