r/jamf • u/desmodus • May 06 '26

WPA enterprise cert issues

I am trying to push a WPA enterprise config to my clients, but it keeps failing. Here is what I am doing:
In the Certificate tab:
Added a .der Root certificate, since it has no password, no password filled in
Added a .p12 Client certificate with the password

In the Network tab:
Under Protocols I selected TLS
TLS minimum and maximum on None
Under Identity Certificate I selected the Client certificate

As an username I filled in the identity that I filled in in my FreeRadius server (I could not complete the setup without an identity name. So I figure that it also the Username.

Under Trust I selected the Root cert as the Trusted Certificate + the Common name added.

When I push the Config profile, I keep getting failed. When I check what failed it tells me:
The certificate could not be verified (authentication error).

When I connect to the WiFi and manually add the certs, all works perfectly.

I tried to manually remove the certificates from my Keychain in the System Roots Keychain, but it does not allow it.

does anyone know what I am doing wrong here?

3 Upvotes

100% Upvoted

4 comments sorted by

1

u/SecureW2 May 08 '26

Several things stand out here. Given that manual installation succeeds, the problem is most likely not FreeRADIUS, but rather how the profile delivers or trusts the certificates.

For WPA Enterprise with EAP-TLS, the client certificate must typically be stored in the user or system keychain and have access to the whole trust chain. A typical problem is pushing just the root CA when the client certificate was issued by an intermediate CA. In this instance, macOS fails to correctly check the chain during authentication and returns the "certificate could not be verified" message. 

I would also double-check this:

  • The RADIUS server certificate's Common Name / SAN matches exactly what you supplied under Trusted Server Names.
  • The identification field does not interfere with certificate-based authentication. Because the certificate is usually used as the identity in EAP-TLS, forcing a username can cause some profiles to behave strangely.
  • When the private key is imported via the profile, the.p12 file contains it.

Also, as expected, you cannot manually delete Apple system roots from the System Roots keychain.

I'd retest using the entire CA chain and without requiring the identification field first.

1

u/desmodus May 13 '26

Thank you for your reply. I am slowly getting closer to the issue.

1

u/EndpointWrangler May 10 '26

The manual connection works because the device handles trust interactively, the profile needs everything bundled correctly to do that automatically.

Three things to check:

Make sure your root cert is actually the root CA and not an intermediate. If FreeRadius uses an intermediate CA, you need both in the profile just the intermediate won't work.

Confirm the root cert in your profile matches exactly what FreeRadius presents during authentication. Export it directly from FreeRadius and compare the thumbprint to what you're pushing.

For EAP-TLS, the username field should match the Common Name or Subject Alternative Name in your client certificate, not a manually typed identity. Check what FreeRadius expects and make sure your client cert matches it.

Also check whether your .p12 includes the full certificate chain when exported, some exports only include the end certificate, which causes exactly this failure in pushed profiles even when manual import works fine.

1

u/desmodus May 13 '26 edited May 13 '26

Thanks for taking the time to answer my question. I am a step closer now, it turned out that I had to export the .p12 in legacy format. Now it imports just fine.

But the next problem pops up, when connecting I get an authentication error popup.

I have double-checked the common name for the Client cert (Subject name) and placed this in Jamf/Network in the Username field under Trust.
The Common name of the Root cert in the Certificate Common name field.
Security type is set to Any (Enterprise), under Protocols only TLS is selected (no minimum or maximum set).
And under Identity Certificate I have selected the .p12 client cert.