Skip to main content
Android Enthusiasts

Return to Answer

add a 3rd section, and change a few choice of words for clarification
Source Link
SombraInca
SombraInca
  • 31
  • 3

TwoThree cents!. Important.

At this time this change in behavior is specific to Android 11 code, December 2020 update, Build number RQ1A/D depending on model.

Important to note that this google change for Enterprise WiFi connection relaterelates to both 1) Possible manual import of the root CA certificate, AND 2) the mandatory use specification of the "Domain" being connected to (as embedded in the cert presented by the AP)

1 - root CA Certificate Handling :1 - root CA Certificate Handling :

1-a) If using a private root CA then user will need to import the private root CA manually, and android (pixel 3 in my case) wants it to be done specifically as a "WiFi certificate" ( as opposed to CA, or VPN, this is just a google requirement)

1 1-b) If the root CA for the certificate presented by the AP is a public one ( see "1" above) then no manual import is needed because WiFi profiles default to "Use system certificates" and thus you are likely already covered ( This system folder is controlled by Google, user cant add/delete any certificates in it only turn on/off)

How to import ? ?: Settings -> "Security" -> "Encryption & credentials" -> "Install a certificate" -> "Wi-Fi certificate" thenthen follow prompts to locate file ( local, google drive, etc),. Important, you can name the cert to easily identify it at time of setting the Wi-Fi profile later on.

2.- Mandatory "Domain" handling2.- Mandatory "Domain" handling

The "Domain" field here is the domain of the CN field in the certificate presented by the AP. One can either enter the FQDN or just the domain portion of that FQDN. This string has to match the one in the CN field (OR thethe x509 Subject Alternate Name (SAN) ) in the certificate that the AP sends to the Phone at time of authentication.  ( I have successfully tested using the CN field only and not he SAN)

How to obtain this field ? : How to obtain this field ? : 2-a) User'sUser's Network Admin will need to provide it. OR

2 2-b) you can usetemporarily borrow a non-WPA3 phone (e.g iphone) toto get the AP certificate and just copy the subject name CN field. As specified above only the domain portion of the FQDN is necessary and sufficient.

DONE !!!3) Configure Wi-Fi Profile

With 1) and 2) taken care off all that is needed is to proceed with the Wi-Fi profile configuration: Click on a new SSID to join a new Enterprise network ( or just click on "Add network") and follow prompts :

3-a ) In "Security" choose WAP/WAP2/WPA3

3-b) In "CA certificate" : i) If public root CA nothing to do. (default "Use system certificates' covers your case). ii) If private root CA, then use dropdown menu to select the root CA cert you imported in Step 1 above

3-c) In "Domain" enter the domain string resulting from completing Step 2 above.

Important:DONE !!! TheseImportant: These changes were not whimsical, but driven by security concerns, and WPA3 standards. Google is forcing the validation of the root CA certificate ( if public CA Google takes care of it via their system root CA certs, if private CA, the onus is on the user to manually import the private root CA cert). Note that the root CA certificate is always validated and that Google gives user choice only to turn off validation of the statusstatus of the certificate NOTNOT the certificate signature itself. TheThe mandatory entry of the domain is to match the domain of the AP certificate against that provided by the user ( the validation of the AP certificate just proves the certificate was signed by a trusted root CA, but how do we know that the domain matches whom we are thinking we are connecting to and not a "man"man-in-the-middle" ? Only way is to force the user to specify it, and verify against the AP certificate one !

Two cents!. Important to note that this google change for Enterprise WiFi connection relate to both 1) Possible manual import of the root CA certificate, AND 2) the mandatory use specification of the "Domain" being connected to (as embedded in the cert presented by the AP)

1 - root CA Certificate Handling :

1-a) If using a private root CA then user will need to import the private root CA manually, and android (pixel 3 in my case) wants it to be done specifically as a "WiFi certificate" ( as opposed to CA, or VPN, this is just a google requirement)

1-b) If the root CA for the certificate presented by the AP is a public one ( see "1" above) then no manual import is needed because WiFi profiles default to "Use system certificates" and thus you are likely already covered ( This system folder is controlled by Google, user cant add/delete any certificates in it only turn on/off)

How to import ?: Settings -> "Security" -> "Encryption & credentials" -> "Install a certificate" -> "Wi-Fi certificate" then follow prompts to locate file ( local, google drive, etc),. Important, you can name the cert to easily identify it at time of setting the Wi-Fi profile later on.

2.- Mandatory "Domain" handling

The "Domain" field here is the domain of the CN field in the certificate presented by the AP. One can either enter the FQDN or just the domain portion of that FQDN. This string has to match the one in the CN field (OR the x509 Subject Alternate Name (SAN) ) in the certificate that the AP sends to the Phone at time of authentication.  ( I have successfully tested using the CN field only and not he SAN)

How to obtain this field ? : 2-a) User's Network Admin will need to provide it. OR

2-b) you can use a non-WPA3 phone (e.g iphone) to get the AP certificate and just copy the subject name CN field. As specified above only the domain portion of the FQDN is necessary and sufficient.

DONE !!!

Important: These changes were not whimsical, but driven by security concerns, and WPA3 standards. Google is forcing the validation of the root CA certificate ( if public CA Google takes care of it via their system root CA certs, if private CA, the onus is on the user to manually import the private root CA cert). Note that the root CA certificate is always validated and that Google gives user choice only to turn off validation of the status of the certificate NOT the certificate signature itself. The mandatory entry of the domain is to match the domain of the AP certificate against that provided by the user ( the validation of the AP certificate just proves the certificate was signed by a trusted root CA, but how do we know that the domain matches whom we are thinking we are connecting to and not a "man-in-the-middle" ? Only way is to force the user to specify it, and verify against the AP certificate one !

Three cents!. .

At this time this change in behavior is specific to Android 11 code, December 2020 update, Build number RQ1A/D depending on model.

Important to note that this google change for Enterprise WiFi connection relates to both 1) Possible manual import of the root CA certificate, AND 2) the mandatory use specification of the "Domain" being connected to (as embedded in the cert presented by the AP)

1 - root CA Certificate Handling :

1-a) If using a private root CA then user will need to import the private root CA manually, and android (pixel 3 in my case) wants it to be done specifically as a "WiFi certificate" ( as opposed to CA, or VPN, this is just a google requirement) 1-b) If the root CA for the certificate presented by the AP is a public one ( see "1" above) then no manual import is needed because WiFi profiles default to "Use system certificates" and thus you are likely already covered ( This system folder is controlled by Google, user cant add/delete any certificates in it only turn on/off)

How to import ?: Settings -> "Security" -> "Encryption & credentials" -> "Install a certificate" -> "Wi-Fi certificate" then follow prompts to locate file ( local, google drive, etc),. Important, you can name the cert to easily identify it at time of setting the Wi-Fi profile later on.

2.- Mandatory "Domain" handling

The "Domain" field here is the domain of the CN field in the certificate presented by the AP. One can either enter the FQDN or just the domain portion of that FQDN. This string has to match the one in the CN field (OR the x509 Subject Alternate Name (SAN) ) in the certificate that the AP sends to the Phone at time of authentication. ( I have successfully tested using the CN field only and not he SAN) How to obtain this field ? : 2-a) User's Network Admin will need to provide it. OR 2-b) you can temporarily borrow a non-WPA3 phone (e.g iphone) to get the AP certificate and just copy the subject name CN field. As specified above only the domain portion of the FQDN is necessary and sufficient.

3) Configure Wi-Fi Profile

With 1) and 2) taken care off all that is needed is to proceed with the Wi-Fi profile configuration: Click on a new SSID to join a new Enterprise network ( or just click on "Add network") and follow prompts :

3-a ) In "Security" choose WAP/WAP2/WPA3

3-b) In "CA certificate" : i) If public root CA nothing to do. (default "Use system certificates' covers your case). ii) If private root CA, then use dropdown menu to select the root CA cert you imported in Step 1 above

3-c) In "Domain" enter the domain string resulting from completing Step 2 above.

DONE !!! Important: These changes were not whimsical, but driven by security concerns, and WPA3 standards. Google is forcing the validation of the root CA certificate ( if public CA Google takes care of it via their system root CA certs, if private CA, the onus is on the user to manually import the private root CA cert). Note that the root CA certificate is always validated and that Google gives user choice only to turn off validation of the status of the certificate NOT the certificate signature itself. The mandatory entry of the domain is to match the domain of the AP certificate against that provided by the user ( the validation of the AP certificate just proves the certificate was signed by a trusted root CA, but how do we know that the domain matches whom we are thinking we are connecting to and not a "man-in-the-middle" ? Only way is to force the user to specify it, and verify against the AP certificate one !

Source Link
SombraInca
SombraInca
  • 31
  • 3

Two cents!. Important to note that this google change for Enterprise WiFi connection relate to both 1) Possible manual import of the root CA certificate, AND 2) the mandatory use specification of the "Domain" being connected to (as embedded in the cert presented by the AP)

1 - root CA Certificate Handling :

1-a) If using a private root CA then user will need to import the private root CA manually, and android (pixel 3 in my case) wants it to be done specifically as a "WiFi certificate" ( as opposed to CA, or VPN, this is just a google requirement)

1-b) If the root CA for the certificate presented by the AP is a public one ( see "1" above) then no manual import is needed because WiFi profiles default to "Use system certificates" and thus you are likely already covered ( This system folder is controlled by Google, user cant add/delete any certificates in it only turn on/off)

How to import ?: Settings -> "Security" -> "Encryption & credentials" -> "Install a certificate" -> "Wi-Fi certificate" then follow prompts to locate file ( local, google drive, etc),. Important, you can name the cert to easily identify it at time of setting the Wi-Fi profile later on.

2.- Mandatory "Domain" handling

The "Domain" field here is the domain of the CN field in the certificate presented by the AP. One can either enter the FQDN or just the domain portion of that FQDN. This string has to match the one in the CN field (OR the x509 Subject Alternate Name (SAN) ) in the certificate that the AP sends to the Phone at time of authentication. ( I have successfully tested using the CN field only and not he SAN)

How to obtain this field ? : 2-a) User's Network Admin will need to provide it. OR

2-b) you can use a non-WPA3 phone (e.g iphone) to get the AP certificate and just copy the subject name CN field. As specified above only the domain portion of the FQDN is necessary and sufficient.

DONE !!!

Important: These changes were not whimsical, but driven by security concerns, and WPA3 standards. Google is forcing the validation of the root CA certificate ( if public CA Google takes care of it via their system root CA certs, if private CA, the onus is on the user to manually import the private root CA cert). Note that the root CA certificate is always validated and that Google gives user choice only to turn off validation of the status of the certificate NOT the certificate signature itself. The mandatory entry of the domain is to match the domain of the AP certificate against that provided by the user ( the validation of the AP certificate just proves the certificate was signed by a trusted root CA, but how do we know that the domain matches whom we are thinking we are connecting to and not a "man-in-the-middle" ? Only way is to force the user to specify it, and verify against the AP certificate one !