Enterprise WiFi and Androids

[synaesthesia]

Starting to have a few more issues with PEAP authentication with newer Android versions and Samsung devices. Up to, I believe, Android 15 it seems quite easy - forgo the CA certificate, provide username and password and remove "anonymous" from the anonymous identity and everything connects hunky dory.

Iphones are even less hassle - username, password, trust the smoothwall certificate. end of. However on newer devices and Samsungs, it won't progress without either using a system certificate or installing one, adding yet another step.

It's easy to say I'd love to ditch BYOD and I still think it's days are numbered but mobile signal round here is non existent. I'd also love to be able to leverage the options in Cambium but.... we all know why that's probably not worth pursuing at the moment.

So for certificates, what exactly are others doing please?

I've tried using system certificate and our local domain but that doesn't work, and not a clue what actual certificate to provide for connecting in the first place. Documentation to this effect seems to be all over the shop and my brain hurts

 

[NegativeKillDeath]

There was an issue in Pixel phones where they dropped the ability to "do not validate" this appears to have been fixed as now they off a Trust on First Use option which will allow you to use a self signed cert and agree to to when connecting much like iOS does. We are seeing this on recent Pixels and Samsungs. So we make sure that the user has the latest update on their phone and this usually works.

[StephenPink]

We've recently gone to the Ruckus CloudPath route due to this issue exactly. And still not perfect, but a smidge easier - Android is the worst, not helped by the amount of variation between manufacturer versions as well. 

The other route is enrol in an MDM... 

i can share instructions from pre-CloudPath if it helps? Again they were reasonably vague though to try to cover the majority of devices without taking into account the specific variations.

Cheers

[synaesthesia]

Cheers, no worries - I did see the Trust on First Use option on the Android 16 device I was trying this morning, but it didn't seem to work. I didn't spend much time on it though, so I'll grab it later.

MDM is out of the question, these are personal devices. With luck the cambium setup gets sorted out and I'll make use of easypass which will allow SSO via Google

[StephenPink]

15 minutes ago, synaesthesia said:

Cheers, no worries - I did see the Trust on First Use option on the Android 16 device I was trying this morning, but it didn't seem to work. I didn't spend much time on it though, so I'll grab it later.

MDM is out of the question, these are personal devices. With luck the cambium setup gets sorted out and I'll make use of easypass which will allow SSO via Google

Yeah you still need to install the root that signs the NPS cert for some Androids, tis annoying. 

Makes sense - am in the same boat. Will easypass also hand certificate distribution? That's the pain point (still)

[psydii]

Its definately worse this september than it has ever been.

[Davit2005]

I'd try and get a public/private signed CA for what's it worth how are you dealing with decryption and deploying those certs if you are?

 

Private CA does have it's benefits but you have got to deploy the cert to devices somehow.

 

We use Eduroam where I am and it is easy to download a profile with the correct certs whether they be Public or Private CA

[synaesthesia]

Decryption is the "easy" part - that's still handled by getting them to install the smoothwall cert via the /getmitm URL as always, it's just this initial bit for authorisation which is adding yet another step.

I'm not aware that Easypass would make it any different regarding inspection, it'd just allow connection similar to NPS with authentication to Google, visible by Smoothwall for monitoring/filtering purposes but still (AFAIK) needs the certificate installing manually.

 

[ITGuyNW]

We have Aruba Central and push out the HPE onboarding app. This authenticates with their Entra ID (so only staff can get on) and then connects them. Seems the easiest way since all this CA Android stuff came about.

[aydee]

3 hours ago, Davit2005 said:

I'd try and get a public/private signed CA for what's it worth how are you dealing with decryption and deploying those certs if you are?

 

Private CA does have it's benefits but you have got to deploy the cert to devices somehow.

 

We use Eduroam where I am and it is easy to download a profile with the correct certs whether they be Public or Private CA

We have found that the easiest way for us, is a memory stick, into a A>C adapter which i can then plug into any android phone and install it from within settings.

I can do the local NPS cert and the Smoothwall cert at the same time too so it sppeds up the procces to comparable speeds to the simpler iphone.

[tom_newton]

Are these BYO or  school devices?

[psydii]

Assuming BYOD, are you installing the root CA or the cert used by the radius server?  Also what about the cert for MITM web traffic inspection?  Does andriod limit the scope for these, or are you required to make personal devices trust all certs for all purposes issued by  your CA?

[synaesthesia]

BYOD - school devices are easy thanks to MDM. Inspection certs as mentioned are also easy, installed as they normally would be (manually) and indeed users must have traffic inspected. Unless, which is quite possible, I'm misunderstanding and the 2 can be linked?

[psynegy]

On 15/09/2026 at 10:03, StephenPink said:

We've recently gone to the Ruckus CloudPath route due to this issue exactly. And still not perfect, but a smidge easier - Android is the worst, not helped by the amount of variation between manufacturer versions as well. 

With CloudPath - what AP's are you using? Are you making visitors use CloudPath with installed certs?

 

We find that visitors from the council, or NHS trusts, often have laptops so locked down you can't install anything on them, let alone a CA cert (quite rightly so)!

[StephenPink]

11 minutes ago, psynegy said:

With CloudPath - what AP's are you using? Are you making visitors use CloudPath with installed certs?

 

We find that visitors from the council, or NHS trusts, often have laptops so locked down you can't install anything on them, let alone a CA cert (quite rightly so)!

R670s/T670s. Nah - for Visitors we use the Guest Portal in R1 instead, with voucher codes that are issued by IT/Reception. No SSL inspection on that network - Securly Guest DNS filtering only. Voucher codes so that it can't be used by students.

Cheers

[psynegy]

That's pretty much exactly what we want to do, only our site is so weird and "wonderful" that we simply cannot afford the Ruckus AP's, so we're hoping to get away with Unifi, but there's definitely some (significant) gotchas integrating Unifi with CloudPath...

[StephenPink]

25 minutes ago, psynegy said:

That's pretty much exactly what we want to do, only our site is so weird and "wonderful" that we simply cannot afford the Ruckus AP's, so we're hoping to get away with Unifi, but there's definitely some (significant) gotchas integrating Unifi with CloudPath...

PM me and can chat pricing/supplier if it helps... I'm not sure I'd want to try and use CloudPath with another vendors APs. 

I've also been speaking to Unifi about their Endpoint app - as that can do one-click WiFi provisioning, but currently can't deploy certificates... 

[psynegy]

Will do! We're just looking at testing the Endpoint app, but need a gateway device before we can do so.

[Fraser_b]

Does anyone in here use Smart Boards and have that working on 802.1x? I'm having so many issues on the boards running never Android. It's runing my life  

[Davit2005]

11 hours ago, Fraser_b said:

Does anyone in here use Smart Boards and have that working on 802.1x? I'm having so many issues on the boards running never Android. It's runing my life  

I think that is going to be a tall order personally. IoT devices rarely play well on 802.1x along with a few other devices i.e. VOIP phones. I think there used to be a way to get working by creating a user in AD then using the MAC address as the username and password (or something along those lines) if you have NPS/radius server setup for it. I did it many years ago for a home project. Is there no way to get an ethernet cable to it, I assume you are talking about WiFi connectivity??

Edited Tuesday at 08:57 by Davit2005

[psydii]

Android is as fussy/more fussy than WIndows 11 about getting it "right". Where "right" is defined by the opinion of the developer of that particular flavour of andriod, and may change between updates. We have EAP-PEAP (MSCHAPv2) for BYOD android devices, and that works well, but the renewal of the server certificate requries the end user to re-trust the NPS cert every couple of years.

Personally, I don't want the boards on the network because after period of time they will stop getting updates, but the devices themselves will be good for another 5-10 years... so you'd have to pull all the network connected features to remain complaint with insurance/dfe standards.

[Fraser_b]

7 hours ago, Davit2005 said:

I think that is going to be a tall order personally. IoT devices rarely play well on 802.1x along with a few other devices i.e. VOIP phones. I think there used to be a way to get working by creating a user in AD then using the MAC address as the username and password (or something along those lines) if you have NPS/radius server setup for it. I did it many years ago for a home project. Is there no way to get an ethernet cable to it, I assume you are talking about WiFi connectivity??

It was always planned for us to use the WiFi network to get them online. We do have trunking and spare network ports in class, but I doubt we have the ports available on the switches, especially in areas where we have PC suites in the school. So it would be quite a cost undertaking to do that in every school across our local authority estate. 

I'll look into your idea of MAC address though as we do use NPS/Radius for the setup. I feel like I've tried everything at this point so one more thing won't hurt 🤣

It looks like I'll be able to get a meeting with a Smart representative from the UK on Thursday (their email support seems to be on the west coast of America/Canada so when i email them during the day, if they reply, it tends to be 9pm when I am no longer at work, so it slows things down. 

[Fraser_b]

6 hours ago, psydii said:

Android is as fussy/more fussy than WIndows 11 about getting it "right". Where "right" is defined by the opinion of the developer of that particular flavour of andriod, and may change between updates. We have EAP-PEAP (MSCHAPv2) for BYOD android devices, and that works well, but the renewal of the server certificate requries the end user to re-trust the NPS cert every couple of years.

Personally, I don't want the boards on the network because after period of time they will stop getting updates, but the devices themselves will be good for another 5-10 years... so you'd have to pull all the network connected features to remain complaint with insurance/dfe standards.

This is the setup we are going for. EAP-PEAP (MSCHAPv2) and putting the root cert on the board but we keep getting a failure on the NPS server for error code 22. It's probably something very simple I am missing. 

I know the 'domain' part can be an issue but I have tried domain.com as well as nps.domain.com in there. I've tried pushing the cert from Smart Remote Management, installing it manually etc etc. Nothing helps. 

Hopefully got a meeting on Thursday with Smart where I will hopefully show them my setup and they will point out my very stupid mistake. 

I'd love the boards to be off the network, but the team responsbile for improving teaching methods across our authority want to be able to cast from the kids chromebooks onto the smartboards. So we need this working on 700+ boards. Boards with older Android OSs seem to connect wirthout issue, Android must not be as strict on those ones at the moment. 

If I find a solutuion and its different from the Smart guidance I'll be sure to make a thread in Edugeeks detailing the fix as I am sure others will come across this problem. 

[psydii]

You’ve mis-matched the EAP type, probably on the client. Check both the policy and the client are set to MSchapv2 (assuming that is what you are going for)

 

[Fraser_b]

23 hours ago, psydii said:

You’ve mis-matched the EAP type, probably on the client. Check both the policy and the client are set to MSchapv2 (assuming that is what you are going for)

 

I'd love it to be that but thats been checked over and over again by myself and someone in our network team. 

The options available on the board or by pushing settings from Smart Remote Management are:

EAP Type - PEAP

Phase 2 Authentication - MSCHAPv2
CA Certificate - Use system certificatge (also tried pointing at the certificate installed as it appears in a dropdown list in this setting
Domain - tried nps.domain.com and domain.com
Identiry and password are both fine. 

The EAP type and phase 2 auth match whats in the NPS profile for the SSID we want the boards to join. 

interestingly I switched on the board today and it was connected to the SSID. I attempted to forget the network and connect again, it got stuck on connecting for ages, stops trying and then goes back to connecting for ages. When I check for an NPS log for this, theres nothing written at this time.