Hi,
You will receive the prompt the first time a new device connects to that SSID. You should really pre-configure the clients or you’re putting the user’s credentials at risk.
Exactly. For a longer treatise on the subject: https://wiki.geant.org/display/H2eduroam/EAP+Server+Certificate+consideratio... (applicability not limited to eduroam) If the OP is doing this for an eduroam installation, said pre-configuration profiles can be built at https://cat.eduroam.org If this is not about eduroam, there are plenty of commercial solutions. A freemium one is https://802.1x-config.org Greetings, Stefan Winter
On 6/14/17, 11:39 AM, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+timc=hpe.com@lists.freeradius.org on behalf of aland@deployingradius.com> wrote:
On Jun 14, 2017, at 11:19 AM, Trevor Jennings <Trevor@simple101.com> wrote: > > We are using Thawte which Apple devices already trust (These are more > common devices on our network).
Do not use public CA certs for WiFi authentication. It's insecure.
And no, the Apple devices do NOT already trust the Thawte cert for WiFi authentication. They trust the Thawte cert for web surfing, which is entirely different.
You need to have a mobileconfig which tells each device what the SSID is, what EAP method to use, and what CA to use.
> Are you referring to configuration profiles that are setup on the clients?
Yes. You need to configure each device as I said above.
In order to get EAP working, follow the guide at:
http://deployingradius.com/documents/configuration/eap.html
It WILL work.
And yes, it involves creating your own certificates, and also installing the certificates on the clients.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66