1

This is my first question here.

I want to connect my RPi to my company WLAN network but there are some problems and I am out of ideas to solve them.

  1. The WLAN does not appear in the list of WLAN's in the GUI WiFi dropdown.
  2. The network guys have given me a .pfx file and said that this is the certificate and key to connect to the company WLAN.
  3. I know that the network uses TLS and does not need a username and a password, just the certificate should be enough?

Could someone please share the wpa_supplicant.conf file that would work with a .pfx certificate and uses TLS WPA2 enterprise WLAN network. Any help would be appreciated. I am losing hope.

Best

0

It should be possible to connect to your companies WLAN network using the .pfx certificate. You have given all needed information. The information to use them you can find with:

rpi ~$ man wpa_supplicant.conf

The important part is at the end. You are using EAP-TLS so you should have a client certificate and a server side certifcate included in the .pfx file, that must converted:

CERTIFICATES
Some EAP authentication methods require use of certificates. EAP-TLS uses both server side and client certificates whereas EAP-PEAP and EAP-TTLS only require the server side certificate. When client certificate is used, a matching private key file has to also be included in configuration. If the private key uses a passphrase, this has to be configured in wpa_supplicant.conf ("private_key_passwd").

wpa_supplicant supports X.509 certificates in PEM and DER formats. User certificate and private key can be included in the same file.

If the user certificate and private key is received in PKCS#12/PFX format, they need to be converted to suitable PEM/DER format for wpa_supplicant. This can be done, e.g., with following commands:

# convert client certificate and private key to PEM format
openssl pkcs12 -in example.pfx -out user.pem -clcerts
# convert CA certificate (if included in PFX file) to PEM format
openssl pkcs12 -in example.pfx -out ca.pem -cacerts -nokeys

It seems that you do not need option private_key_passwd because they told you there is no protection of the client certificate with an additional password.

To setup wpa_supplicant.conf you should start with the example given with:

# work network; use EAP-TLS with WPA; allow only CCMP and TKIP ciphers
network={
   ssid="work"
   scan_ssid=1
   key_mgmt=WPA-EAP
   pairwise=CCMP TKIP
   group=CCMP TKIP
   eap=TLS
   identity="user@example.com"
   ca_cert="/etc/cert/ca.pem"
   client_cert="/etc/cert/user.pem"
   private_key="/etc/cert/user.prv"
   # private_key_passwd="password"
}

Maybe you will need some try and error but it should do.

  • awesome, thank you so much. You are a life-saver!!!, I will get it a try tonight and give you feedback. – Robotics nerd Apr 23 at 15:32
  • unfortunately it does not work. I extracted client and server certificates (ca.pem & user.pem) from the .pfx file. Then I extracted the "user.key" which has a key just like SSH key used in github. Sometimes the RPi says "no wireless interfaces found" and sometimes it shows all the available WLAN networks with the WPA ones grayed out but does not connect to the work_wifi even if I reboot multiple times :/ – Robotics nerd Apr 24 at 7:50
0

I was also having this issue for my automation solution Ive provided to Industry. Mostly It depends on what type of security is implemented in WPA-Enterprise WiFi settings done by IT admins while setting up RADIUS server and WiFi setup. Its difficult to guess so mostly it looks like impossible to connect to few Enterprise networks without any help from IT department.

Recently I found another way to do this. Changing options doing trial and error from wpa_supplicant is tedious job. wpagui is better solution to try different options for Enterprise WiFi connection.

Its mostly not present in latest Rasbian OS and can be installed and run by :

sudo apt-get install wpagui
sudo wpa_gui

I'll test this in next few days and report here.

  • What does wpa_gui do? Have you had a look at wpa_cli? Is there a difference beside the graphical user interface? – Ingo Oct 26 at 10:21
  • @Ingo, this is not about difference. This is about ease of use. If you know about WPA/WPA2 - Enterprise Setup, Its very difficult to get exact settings if its not already known. Enterprise WiFi connection parameter has multiple possibilities. Might be different as per system admins choice. Most of the time WiFi infrastructure is managed centrally by some agency and its difficult to get proper technical support for this. So only way to to do this is try different options to make successful connection. – Rajendra Oct 26 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.