2

My Wi-Fi uses 802.1x EAP with TLS. It works well with the old Android devices, but an Android 10 device pretends that it's trying to connect, and a few seconds later marks the connection as disabled. There is absolutely nothing in the Radius logs about any failed connection attempt.

The configuration is quite the same between this device and the older ones, with two differences:

  • Security field is unavailable, unless I chose to manually add the network, in which case there is no “802.1x EAP,” but only “WEP,” “WPA/WPA2-Personal” and “WPA/WPA2/WPA3-Enterprise.” I suppose that I need to chose the last one.

  • Domain field is added between CA Certificate and User certificate. I tried to keep it empty or enter the domain name of the company; the result is the same.

What can I do to understand why doesn't the device attempt to talk to the Radius server before marking the connection as disabled?

Improve this question

1 Answer 1

Reset to default
1

Before the client (aka supplicant) can talk to the authenticator it must first establish a TLS connection. The failure might be occurring in the EAPOL START before a user authentication (TLS auth) can occur. This might be why you do not see any authentication attempts on the Radius server.

Yes you must select WPA/WPA2/WPA3-Enterprise in order to do EAP-TLS. You need to specify both the CA Certificate and Client certificate in order to complete the EAP TLS Flow.

Are you familiar with Android Logcat? You could start looking there and filtering on wpa_supplicant or EAPOL to see if there are any certificate validation or related errors.

Guessing why here but, it's possible your older devices will work with the same CA/Client certificate depending how old they are. Certificate validation has improved (strengthened) in android over the years and it might be why its failing on new devices and not older.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .