2

I can't connect to campus WiFi anymore after installing latest ROM with december 2020 security patches. The configuration is PEAP/MSCHAPV2. Under CA certificate, we usually choose "Do not validate" but now CA certificates is set to "Use system certificates" and can't be changed. "Use system certificates" setting requires Domain name which I don't know and have never needed to use before in any ROM.

See the screenshot.

Is there any workaround to choose "Do not validate" in "CA certificate"?

1
  • The behaviour is as intended in Android 11 with December 2020 security patches. See the link. This will need to be resolved by WiFi network administrators. – Yogesh Yadav Dec 12 '20 at 9:00
0

Have you asked the IT department from your campus ?

Looks like if you 'just' enter the correct domain, it should work with the system certificates. If so, then you would end up with a more secure WiFi connection.

The article where Yogesh is pointing at, is more an advertisement than independent information. Obvious that securew2 is writing to use their products instead of another solutions.

The root of the problem is a user unfriendly way to connect to a Wifi network in Android. In many other OS's you need to 'trust' a certificate, which is needed for a safe connection.

Before December update, Android gave 2 options:
1st solution is to import a certificate on a smartphone. Which manually is a hell, or by using an app. (Like securew2, connect this with the site were the article is hosted)

2nd option was to 'not validate' the certificate, and just trust any certificate presented. This however is of course less secure, but a lot more user friendly and can be explained. The risk is that if someone (with bad intentions) set up a network with the same 'name'/SSID, the android phone connects regardless, without warning you are connecting to a rogue network.

To address the security problems in the second option Android has removed the do not validate option and (according to your screenshot) it seems to be replaced by using system certificates (with a domainname check).

I am curious If you can connect when you would use the correct domain name.

0

"Do not validate" has been removed by Android.

You need to use the domain name of the server certificate being used by the authentication server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.