2

I want to connect a Linux machine to WPA2 Enterprise Wi-Fi (that I manage). The certificates I created with OpenSSL work well with Android and iOS devices, but I can't figure out what types of certificates are expected by wpa_supplicant.

Basically, I have a ca.pem, and, for a given device, the following files are being generated:

  • demo.crt
  • demo.csr
  • demo.key
  • demo.p12

It looks like wpa_supplicant can work with either a file containing both the public and the private certificate, as well as two files. Originally, I was using two files:

  • demo.key
  • demo.pem, created by running openssl pkcs12 -in demo.p12 -out demo.pem -clcerts.

wpa_supplicant.conf was configured like this:

network={ ssid="HelloWorld" key_mgmt=WPA-EAP pairwise=CCMP group=CCMP eap=TLS identity="[email protected]" ca_cert="/etc/ssl/private/ca.pem" client_cert="/etc/ssl/private/demo.pem" private_key="/etc/ssl/private/demo.key" private_key_passwd=... }

The authentication fails with the following error:

OpenSSL: tls_read_pkcs12 - Failed to use PKCS#12 file error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

If I remove client_cert and use only private_key, pointing to the .pem file, the error is still the same.

If I point it to .p12, the error is:

OpenSSL: tls_connection_private_key - Failed to load private key error:00000000:lib(0):func(0):reason(0)

Debian's documentation tells that the PEM should be created from a .pfx. When I do that:

openssl pkcs12 -export -out demo.pfx -inkey demo.key -in demo.crt -certfile ca.crt openssl pkcs12 -in demo.pfx -out demo.pem -clcerts

the original error is back:

OpenSSL: tls_read_pkcs12 - Failed to use PKCS#12 file error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

How exactly should I generate the certificates for wpa_supplicant?

Improve this question
7
  • If you are creating your certificates on the windows side, either this is not the right group to ask or the question is not correctly framed. Commented Apr 28, 2020 at 1:15
  • @RuiFRibeiro: Windows side? The certificates are generated on a Linux machine. Although I'm not sure how this is relevant: I suppose that OpenSSL generates the same certificates independently of the operating system. Commented Apr 28, 2020 at 14:13
  • Ah. Debian docs does not say you need .pfx, hence the confusion. It says it needs PEM, no matter what format it is received. For EAP-TTLS, client certificates are not mandatory. (and Windows use their own tools) Commented Apr 28, 2020 at 17:16
  • @RuiFRibeiro: I see. Sorry, my question is indeed not easily readable, but I can't figure out how can I make it more readable without removing necessary details. Essentially, the question itself is in the title. The details are here to avoid answers which barely tell what I already know/have tried, such as “Simply use .p12 and it will work”—no, it won't. Commented Apr 28, 2020 at 21:26
  • Are you authenticating users via certificate or is just the server certificate? Or both? Are Windows or mobile clients authenticating? Commented Apr 29, 2020 at 11:06

1 Answer 1

Reset to default
2

In your wpa_supplicant.conf file, it should be eap=TTLS

As in:

network={ ssid="HelloWorld" key_mgmt=WPA-EAP pairwise=CCMP group=CCMP eap=TTLS identity="[email protected]" ca_cert="/etc/ssl/private/ca.pem" client_cert="/etc/ssl/private/demo.pem" private_key="/etc/ssl/private/demo.key" private_key_passwd=... }

Also, depending on the configuration, you might need anonymous_identity and phase2.

Supposing it is EAP-TTLS-MSChapv2:

network={ ssid="HelloWorld" key_mgmt=WPA-EAP pairwise=CCMP group=CCMP eap=TTLS identity="[email protected]" ca_cert="/etc/ssl/private/ca.pem" client_cert="/etc/ssl/private/demo.pem" private_key="/etc/ssl/private/demo.key" private_key_passwd=... phase2="auth=MSCHAPV2" }
Improve this answer
1
  • The question was about EAP-TLS, but the answer is for EAP-TTLS-MSCHAPv2. As long as this is your private AP you could just change the authentication protocol. In the general case you cannot. Commented Jun 25, 2021 at 11:17

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.