Android 11 does not trust a theoretically properly imported private CA for WiFi EAP-TLS

Question

This question is similar, but unrelated to this one answered two days ago.

I have been using WiFi EAP-TLS at home, for nearly a full year, with multiple desktop operating systems and Android 10 with zero problem. Android 11 is a different story, Google changed EAP requirements so CAs must be validated. I have always imported the CA and selected options to verify CA on all my devices, the trust chain is important to me. Unfortunately, it's not working on Android 11, the WiFi bugcheck logs say, "Certificate verification failed, error 19 (self signed certificate in certificate chain)," and points to the private CA. As far as I am aware, root trust Certificate Authorities, whether public or private, are always self-signed.

Herein lies the problem. CAs must be self-signed, yet Android 11 does not trust self-signed certificates. I have the CA supposedly imported properly into the "User" CA store, it is displayed there, and the per-device client certificate is imported into the WiFi store.

I've also asked this question in two places on Reddit, where a couple educational network admins also have the same CA problem, but no answers have been discovered yet. I'm hoping someone on this forum knows what's up. Any pointers will be much appreciated!

(I would have also added tags "eap-tls" and "certificate-authority" but I don't have enough reputation yet)

Answer 1

For anyone who doesn't want to trust a public CA for their network: we made this work by ensuring the dnsNme was set correctly on our certificates. We had our CN equal to a domain, and our SAN incorrectly had the DNS field of SAN equal to a string like "Our RADIUS Server". Changing this to a proper domain and setting the "domain" field in the settings made this work.

From the Android SDK docs (what a place to find an answer to this), if an SAN is present, it is preferred over a CN.

https://developer.android.com/reference/android/net/wifi/WifiEnterpriseConfig#setDomainSuffixMatch(java.lang.String)

Answer 2

This issue has been resolved with assistance from Reddit's /r/networking community. The thread states the RADIUS server certificate must be issued by a public CA. Client certificates can (and should) still be issued by private PKI. The new Domain field in the wifi config dialog must be the CN or subjectAlternateName of the server certificate, per WAP3 specification. I did not need to install the private CA into Android 11.