RADIUS changes due to Android 11

[Primus]

Hi all, I've seen a fair bit of chat online about the changes Google has pushed out to some handsets already with Android 11 that impacts on RADIUS.

 

It disables the ability to select "Do not validate", preventing users from joining RADIUS authenticated networks using private PKIs.

 

The changes relate to WPA3 so I think this will eventually impact all devices and I'm looking to get ahead of the game.

 

Has anyone implemented a solution for this?

 

From what I can see there are 2 real options:

1. Purchase a proper certificate - I've seen many people online say this is a bad idea since it's misusing the certs and they could be revoked without notice and it also introduces a small chance of a MITM attack.

2. Host the certificate generated by our PKI somewhere publically available and have users download it and trust it prior to trying to connect to the WiFi

 

Any thoughts or solutions gratefully received!

[chris11256]

We've gone with option 2 for the few Android devices that require it. The certificate is stored within the IT pages of our VLE along with some instructions.

[Primus]

I'm doing some testing now with the cert. Edited February 14, 2022 by Primus

[slugshead]

Option 2.

 

We've found that so far, it's only Pixels that require it. Other manufacturers didn't add that small part to their flavour of Android.

[Primus]

Option 2.

 

We've found that so far, it's only Pixels that require it. Other manufacturers didn't add that small part to their flavour of Android.

 

Yeah I think that's for now - if it's part of WPA3 it's coming to everything I'd say, eventually.

[slugshead]

It should, but look at how many large orgs use Samsung and KNOX. can you imagine the fallout if Samsung rolled it out in their version of Android? It would be carnage.

[DavidYoung]

We've been testing option 1 on a small number of devices (Pixel 5, 6 and my OnePlus Nord has the same restriction).

 

We use a LetsEncrypt certificate deployed using DNS validation. The end-users need to enter a domain name when they connect. We issued the cert to wifi.domain.org but the end user only needs to enter domain.org for it to validate.

 

I haven't seen anything suggesting this is not good practice or that it is misusing the certificate. Can you please share where you discovered this?

[Primus]

This Reddit thread which links to others: https://old.reddit.com/r/networking/comments/lbdafp/8021x_ise_android_11_problem/

 

I've tried deploying the cert from our Smoothwall which is handling the auth and although it seems to be the same as the one presented when a device tries to authenticate it doesn't like it.

[slugshead]

old.reddit.com

 

Glad I'm not the only one who hates new layout.

[DavidYoung]

This Reddit thread which links to others: https://old.reddit.com/r/networking/comments/lbdafp/8021x_ise_android_11_problem/

 

I've tried deploying the cert from our Smoothwall which is handling the auth and although it seems to be the same as the one presented when a device tries to authenticate it doesn't like it.

 

Interesting read and a lot of conflicting opinions in that thread, many say simply deploying CA trusted certs fixed the problem which is what we experienced. As I say, we are only piloting it as we found that there are some other caveats, particularly when renewal comes around and it requires extra steps from the end user to enter the correct domain name for the cert to validate.

 

I think those against it in the thread and other articles I've found online are against the idea of using passwords in this manner entirely and recommend to use client certificates to authenticate. This makes a lot of sense as it is an area that could very easily lead to credential theft and can't be secured by multi-factor authentication, etc.

 

The best option would be to use a RADIUS infrastructure with an onboarding app/site/similar which would authenticate using the school's IdP (e.g. Google/Microsoft, etc.) and then provision the correct client and server certificates onto the device as a profile so that the actual connection is secured using that certificate going forward.

 

I know some wireless vendors provide this and there are also some 3rd party apps that can act as RADIUS servers to any infrastructure but these can be quite expensive.

[Primus]

Those of you using a proper cert do you still find iOS devices prompt you to trust the certificate on the very first connection?

[DavidYoung]

Those of you using a proper cert do you still find iOS devices prompt you to trust the certificate on the very first connection?

 

Yes, no difference on iOS or Windows devices.