Not particularly helpful today, but in the WPA3 standard there is an /optional/ standard called DPP or EasyConnect. It was born from the old WIPS protocol. DPP is meant as a general onboarding standard primarily focused for IoT devices, but nothing explicitly prevents it from being used more generally. Basically, it creates an out-of-band connection (think Bluetooth) to a configuration node which will push a wireless config (including certs). At this point I’m not sure anyone actually supports it, but at least it’s an adopted standard (even though it’s an optional one). Maybe one day these frustrations will be behind us On Thu, Dec 2, 2021 at 6:56 PM Alan DeKok <aland@deployingradius.com> wrote:
On Dec 2, 2021, at 4:10 PM, Chris Bradley <bradleyc@bcsc.k12.in.us> wrote:
What we want to do is allow BYOD devices to connect to our freeradius server (using LDAP authentication) and connect by putting the domain entry in for connecting with an android.
That *might* work. However... many systems have known root CAs enabled for web surfing, but disabled for EAP. Which means the only way to get WiFi working is to ??? somehow enable / add a root CA.
I've been arguing this point with the various standards bodies for a while. Apparently the people who interact with customers are few and far between there. So things hated by real people just aren't a priority to fix in the standards. :(
Ultimately, I'm trying to put a certificate on the freeradius server so that BYOD clients (android 11+ specifically) can authenticate using LDAP *without* them having to download a certificate from somewhere before attempting the connection to freeradius.
I've bene trying to do the same thing for a while. it's hard.
The simple answer is things like Eduroam CAT: https://cat.eduroam.org/
It get you a simple tool to configure end-user machines. But it means you should be part of Eduroam. Which you might want to do anyways...
From what I understand, I can't do that with a wildcard certificate or a self-signed one.
So, if that's possible, I need some guidance on how to get it accomplished and what kind of cert I need to procure.
"Here be dragons" :(
OS / Phone vendors randomly change requirements, UI, processes, work flows, etc. for WiFi configuration. It's a huge problem.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Munroe Sollog (He/Him/His) Network Architect munroe@lehigh.edu