1

I'm using a Google Pixel 3a. A week ago, it was connecting all well to the corporate Wi-Fi which uses WPA Enterprise, but recently, it stopped.

In order to connect, I do the following:

  1. Download the ca.pem file containing the CA certificate and the .p12 file containing the device certificate.
  2. Install both CA and device certificates through Security › Encryption & credentials › Install a certificate › Wi-Fi certificate.
  3. Configure the Wi-Fi to use those certificates.
  4. EAP method being set to TLS, just as before.

As soon as I try to connect, it fails with no error message or details, and the CA certificate gets removed from the User credentials list (the ca.pem file is preserved). The behavior is the same no matter what I set in Online certificate status field (including “Do not validate” value that I can still use).

Why would Android remove the CA certificate? What do I need to do to make it stop doing that, and use the certificate to actually open the Wi-Fi connection?

Improve this question
5
  • Is the Wifi certificate that is removed valid (certification path present and valid + not expired)?
    – Robert
    Commented Jun 1, 2021 at 7:01
  • @Robert: the certificate is not expired. Regarding the validity of the certification path, how can I check it?
    – Arseni Mourzenko
    Commented Jun 1, 2021 at 7:38
  • How to check the path of a certificate on Android . a good question. On plain Android I think this is not possible. There are a lot of app in Play Store that allow you to view certificates, but if the validate them?
    – Robert
    Commented Jun 1, 2021 at 7:56
  • @Robert: what about Linux? In fact, I'm not sure what you mean here by validity. This is a corporate self-generated CA certificate. The client Wi-Fi certificate is based directly on the CA one. Is Android expecting a certificate based on a public certificate authority now?
    – Arseni Mourzenko
    Commented Jun 1, 2021 at 8:06
  • Google has made some changes for connecting to WPA Enterprise Wifi networks. See for example android.stackexchange.com/q/231859/2241 It is possible that those changes also the way how certificates are handled. Another reason could be that the CA defines revocation endpoints (CRL or OCSP) and Android tries to contact them but fails.
    – Robert
    Commented Jun 1, 2021 at 9:11

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .