Configuring WPA2 Enterprise with EAP-TLS in Mac OS X and Linux

Setting up the CA

Follow the steps on setting up a Certificate Authority (CA) using OpenSSL.

Issuing the client certificate and private key

Once the CA has been configured, we will generate a private key and an unsigned public key digital certificate.

# openssl req -new -days 365 -newkey rsa:1024
-keyout sslkey.pem -out unsigned.pem

The unsigned public key digital certificate, stored in a PEM-encoded file named unsigned.pem will be sent to the CA for signing:

# openssl ca -in unsigned.pem -out cert.pem

Installing the client certificate and private key

The next step consists in installing the private key, public key digital certificate and CA public key certificate.


The private key, public key digital certificate and CA certificate files should get installed into a location where only root and wpa_supplicant can access them, for example, /etc/wpa:

# mkdir /etc/wpa
# chown root.root /etc/wpa
# chmod 700 /etc/wpa

Mac OS X

Mac OS X can only import private keys in PKCS#12 so we need to export all the previous items to a suitable format:

# openssl pkcs12 -export -in cert.pem -inkey key.pem
-out client.p12 -name "host.domain"

Where "host.domain" denotes the FQDN of the host which this digital certificate and private key are intended for.

The output file client.p12 contains the private key and public key digital certificate. This bundle should get moved to the host using a secure distribution channel, like an SSH/SCP/SFTP session or a USB key. Also, the CA digital certificate, usually named cacert.pem, should also get copied to the host.

On Mac OS X, using the GUI, double click the cacert.pem file, and install the CA certificate into the X509Anchors keychain. This a system-wide keychain intended to store X.509 CA root digital certificates.

Next, using the GUI, double click on client.p12 file, supply the password that protects the private key stored in this file, and choose to install both the private key and public key into the login keychain. Next, make sure the private key has been installed:

Configuring the AirPort Express Wireless Access Point

Launch AirPort Admin Utility, select the desired base station and click the Configure icon from the toolbar:

Click the Change Wireless Security… button:

In this new window, fill in the information about the RADIUS server, like its IP address, shared secret and so on.

Configuring the Supplicant for WPA2 Enterprise


Create /etc/wpa_supplicant.conf using the following data:


The identity directive is required, or else the EAP-TLS negotiation will fail.

ap_scan=2 and scan_ssid=1 are needed when the Wireless Acccess Point is configured to not broadcast the ESSID.

Mac OS X

Launch Internet Connect from the Wireless menu:

If no 802.1X icon appears on the toolbar, choose File -> New 802.1X Conection…. Click the 802.1X icon. The window will look like this:

From the Configuration drop-down, select Edit Configurations…:

A window like this will open:

Fill in both the “Description” and “Wireless Network” fields with the ESSID of the Wireless network. Leave “User Name” and “Password” blanked, since we are not using password-based authentication.

From the “Authentication” listbox, clear the checkbox for all the protocols except for TLS. Select the TLS protocol and click the Configure button. A new window will open for you to select the private key that will be used for the EAP-TLS authentication mechanism:

From the drop-down listbox, select the name of the private key that matches the name of the private key installed in the previous section.

Click the Connect button. The Supplicant will authenticate against the Wireless Access Point. At this point, it is possible that Mac OS X asks confirmation for accessing the private key stored in your keychain. It is recommended to “Always Allow” the Supplicant access to the private key.

Launch System Preferences -> Network and Configure… the AirPort interface:

Click the “+” button to add a Preferred network:

Just enter the ESSID of the Wireless network and choose WPA2 Enterprise from the Wireless Security drop-down listbox. Also, make sure the Configuration field shows the name of the 802.1X configuration we created previously using Internet Connect.

Leave the rest of the fields blank, since we are not using password-based authentication.

19 thoughts on “Configuring WPA2 Enterprise with EAP-TLS in Mac OS X and Linux

  1. I want to use WPA-EAP with Openssl CA for distributed authentication in wireless mesh network, the device is Linsys 45gl router with OpenWrt firmware, is it posssible, thanks for any replly.

  2. I am trying to configure the airport express to access a college campus network with 802.1x, PEAP Security. After an hour and a half with Apple supprt I could not get the Airport Express to show and then accept the certificate and connect. This ability does not seem to be available in the Admin Utility. Do you know how I can do this… Thanks

  3. What an excellent piece of text! No idea how you were able to write this’d take me long hours. Well worth it though, I’d suspect. Have you considered selling advertising space on your blog?

  4. I have observed that in the world these days, video games will be the latest rage with children of all ages. Occasionally it may be extremely hard to drag your children away from the activities. If you want the very best of both worlds, there are various educational video games for kids. Good post.

  5. I think this is among the such a lot important info for me. And i’m satisfied studying your article. But want to commentary on some normal issues, The website taste is perfect, the articles is actually excellent : D. Excellent activity, cheers

  6. Not even a little bit. Not to say nobody has tried to make me stop being a Mormon, but I’m not letting any of their nonsensical jabs bring me away from Heavenly Father.

  7. With environmentalists stressing on the belief that there must be optimum utilization resources on earth, solar panels are a terrific way to use the suns electricity.

  8. Hey! Quick question that’s completely off topic. Do you know how to make your site mobile friendly? My web site looks weird when browsing from my apple iphone. I’m trying to find a template or plugin that might be able to resolve this issue. If you have any recommendations, please share. Many thanks!

  9. No enterprise is a bit more prone to succeed than a single concealed in the enemy until it’s ripe for execution.
    Almost all of the considerations on the globe are already accomplished by those who have maintained on trying when there was no hope whatsoever.

  10. how many calories in a grapefruit half, Wonderful website you have here but I was curious if you knew of any discussion boards that cover the same topics talked about in this article? I’d really love to be a part of group where I can get comments from other experienced individuals that share the same interest. If you have any suggestions, please let me know. Appreciate it!

  11. With havin so much content do you ever run into any issues of plagorism or copyright infringement? My site has a lot of unique content I’ve either written myself or outsourced but it appears a lot of it is popping it up all over the web without my permission. Do you know any techniques to help stop content from being ripped off? I’d truly appreciate it.

  12. Wanted to drop a comment and let you know your Rss feed isnt functioning today. I tried including it to my Google reader account but got absolutely nothing.

  13. Thanks for another informative website. Where else may just I am getting that kind of info written in such a perfect means? I have a venture that I’m simply now working on, and I have been on the look out for such info.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s