I can't connect to campus WiFi anymore after installing latest ROM with december 2020 security patches. The configuration is PEAP/MSCHAPV2. Under CA certificate, we usually choose "Do not validate" but now CA certificates is set to "Use system certificates" and can't be changed. "Use system certificates" setting requires Domain name which I don't know and have never needed to use before in any ROM.
Is there any workaround to choose "Do not validate" in "CA certificate"?
On a rooted phone, first try to connect to the WiFi network (although it will fail), then turn off WiFi entirely. Now, modify /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml. Find the entry for your WiFi network, and set DomSuffixMatch (which is what the UI shows as 'Domain') and CaPath to empty strings. Maybe set other similar entries to blank strings also, for example CaCert. Here's what my WifiEnterpriseConfiguration section looks like:
<WifiEnterpriseConfiguration>
...
<string name="ClientCert"></string>
<string name="CaCert"></string>
<string name="SubjectMatch"></string>
...
<string name="AltSubjectMatch"></string>
<string name="DomSuffixMatch"></string>
<string name="CaPath"></string>
...
</WifiEnterpriseConfiguration>
Now, reboot your phone, verify that your changes in WifiConfigStore.xml were saved, and try to connect to the WiFi network.
It should be possible to write an app to do this, without requiring root. Docs for WifiEnterpriseConfig, and example usage on stackoverflow
Of course this is insecure (anyone could create a fake WiFi network and steal your credentials), but any https connection within the network is still OK.
(Tested on Pixel 3, LineageOS 18.1, Android 11)
To add to XMB5's answer, you can do this on a rooted phone using the following commands:
adb shell
su
sed -i 's%<string name="CaPath">.*</string>%<string name="CaPath"></string>%' /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml
sed -i 's%<string name="DomSuffixMatch">.*</string>%<string name="DomSuffixMatch"></string>%' /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml
reboot
(I included CaPath and DomSuffixMatch because only these two seem to be required to get past the UI)
Note: This clears the domain and CA certificate of all saved networks. You probably don't need to worry, unless you have multiple enterprise networks with 802.1X authentication saved. In that case, you can run this script, and then reconfigure the other networks through UI.
Have you asked the IT department from your campus ?
Looks like if you 'just' enter the correct domain, it should work with the system certificates. If so, then you would end up with a more secure WiFi connection.
The article where Yogesh is pointing at, is more an advertisement than independent information. Obvious that securew2 is writing to use their products instead of another solutions.
The root of the problem is a user unfriendly way to connect to a Wifi network in Android. In many other OS's you need to 'trust' a certificate, which is needed for a safe connection.
Before December update, Android gave 2 options:
1st solution is to import a certificate on a smartphone. Which manually is a hell, or by using an app. (Like securew2, connect this with the site were the article is hosted)
2nd option was to 'not validate' the certificate, and just trust any certificate presented. This however is of course less secure, but a lot more user friendly and can be explained. The risk is that if someone (with bad intentions) set up a network with the same 'name'/SSID, the android phone connects regardless, without warning you are connecting to a rogue network.
To address the security problems in the second option Android has removed the do not validate option and (according to your screenshot) it seems to be replaced by using system certificates (with a domainname check).
I am curious If you can connect when you would use the correct domain name.
"Do not validate" has been removed by Android.
You need to use the domain name of the server certificate being used by the authentication server.
Well you can try to fill in the last part of your email addresses for domain - so everything after the "@". like my last part of email address is isbstudent.comsats.edu.pk
As written in one of the guides, normally you would enter the domain address of the authentication server / the common name which is part of the certificate of the server...
It worked for me!!!
