Android 7.1 has introduced some changes to Wi-Fi connection interface.
In 6.0, when selecting PEAP MSCHAPv2 in Wi-Fi connection interface, there were no CA certificates available (unless some had been installed). In 7.1 one can Use system sertificates and Domain input field appears.
So, for example, I want to connect to Eduroam, that requires thawte Primary Root, using login [email protected]. What am I supposed to type in Domain and Identity fields?
Assuming you want to use the email address [email protected], Domain would be uni.org and Identity would be [email protected].
Source: XDA developers and originally Virginia Tech Helpdesk
Three cents!. .
At this time this change in behavior is specific to Android 11 code, December 2020 update, Build number RQ1A/D depending on model.
Important to note that this google change for Enterprise WiFi connection relates to both 1) Possible manual import of the root CA certificate, AND 2) the mandatory use specification of the "Domain" being connected to (as embedded in the cert presented by the AP)
1 - root CA Certificate Handling :
1-a) If using a private root CA then user will need to import the private root CA manually, and android (pixel 3 in my case) wants it to be done specifically as a "WiFi certificate" ( as opposed to CA, or VPN, this is just a google requirement) 1-b) If the root CA for the certificate presented by the AP is a public one ( see "1" above) then no manual import is needed because WiFi profiles default to "Use system certificates" and thus you are likely already covered ( This system folder is controlled by Google, user cant add/delete any certificates in it only turn on/off)
How to import ?: Settings -> "Security" -> "Encryption & credentials" -> "Install a certificate" -> "Wi-Fi certificate" then follow prompts to locate file ( local, google drive, etc),. Important, you can name the cert to easily identify it at time of setting the Wi-Fi profile later on.
2.- Mandatory "Domain" handling
The "Domain" field here is the domain of the CN field in the certificate presented by the AP. One can either enter the FQDN or just the domain portion of that FQDN. This string has to match the one in the CN field (OR the x509 Subject Alternate Name (SAN) ) in the certificate that the AP sends to the Phone at time of authentication. ( I have successfully tested using the CN field only and not he SAN) How to obtain this field ? : 2-a) User's Network Admin will need to provide it. OR 2-b) you can temporarily borrow a non-WPA3 phone (e.g iphone) to get the AP certificate and just copy the subject name CN field. As specified above only the domain portion of the FQDN is necessary and sufficient.
3) Configure Wi-Fi Profile
With 1) and 2) taken care off all that is needed is to proceed with the Wi-Fi profile configuration: Click on a new SSID to join a new Enterprise network ( or just click on "Add network") and follow prompts :
3-a ) In "Security" choose WAP/WAP2/WPA3
3-b) In "CA certificate" : i) If public root CA nothing to do. (default "Use system certificates' covers your case). ii) If private root CA, then use dropdown menu to select the root CA cert you imported in Step 1 above
3-c) In "Domain" enter the domain string resulting from completing Step 2 above.
DONE !!! Important: These changes were not whimsical, but driven by security concerns, and WPA3 standards. Google is forcing the validation of the root CA certificate ( if public CA Google takes care of it via their system root CA certs, if private CA, the onus is on the user to manually import the private root CA cert). Note that the root CA certificate is always validated and that Google gives user choice only to turn off validation of the status of the certificate NOT the certificate signature itself. The mandatory entry of the domain is to match the domain of the AP certificate against that provided by the user ( the validation of the AP certificate just proves the certificate was signed by a trusted root CA, but how do we know that the domain matches whom we are thinking we are connecting to and not a "man-in-the-middle" ? Only way is to force the user to specify it, and verify against the AP certificate one !
I've learnt that the domain refers to the address of the RADIUS server of the network:
The university used to ask to install a Thawte certificate for WiFi connection. Then, then switched to DigiCert and the installation is not necessary anymore. So, their new config is now like:
PEAP
MSCHAPv2
Use system certificates
radius.uni.edu
[email protected]
___
password
Obviously, it's a particular case, but the idea is clear.