Skip to main content
Question

Deploy EAP-TLS WPA2E SSID with user certs

  • October 24, 2016
  • 5 replies
  • 43 views
C
Forum|alt.badge.img+3

Hi together,

firstly I would like to say that I am new to the community and hope to find some help here. Also a sorry if the form of creating questions may not be correct.

We would like to pre-publish a network SSID via plist or script of possible which does eap-tls auth with a user based certificate ( due to mac is not AD bound ) we can assume the certificate is already stored within the keychain.

I already created following bash script:

#!/bin/bash

networksetup -addpreferredwirelessnetworkatindex en0 NETWORKNAME 1 WPA2E
security set-identity-preference -c "USER NAME" -s "NETWORKNAME"

this alread pre-populates the network ssid but user still has to select EAP-TLS and correct certifcate.

To make clear what I want to do i attach pictures to manually connect to the network:


Thanks for the help

5 replies

T
Forum|alt.badge.img+12
  • Tigerhaven
  • Contributor
  • October 25, 2016

Hi Chris, how did you get the user cert on a non ad machine using jamf ? should you not have active directory authentication issues ?

Kunal V
S
Forum|alt.badge.img+2
  • sislam
  • New Contributor
  • October 25, 2016

@Tigerhaven no, there are PKI solutions that can generate the certificates without joining the Mac to the domain via self-enrollment (like Symantec Managed PKI).

C
Forum|alt.badge.img+3
  • Chris83
  • Author
  • New Contributor
  • October 25, 2016

Yes @sislam is right, there are PKI solutions facing this. Anyone a idea how this could be handled?

T
Forum|alt.badge.img+12
  • Tigerhaven
  • Contributor
  • October 25, 2016

@sislam and @chris83 for microsoft based certs any suggestions that work well with jamf ?

Kunal V
C
Forum|alt.badge.img+3
  • Chris83
  • Author
  • New Contributor
  • October 27, 2016

The local machine does not have any microsoft based certs to work with, that is one of the features of using PKI.

Basically this is just setting a identity for a configured ssid based on a certificate in the keychain. Maybe I am on the wrong track but according to this page: https://discussions.apple.com/thread/4922201?tstart=0 it should help.

Terms & ConditionsCookie settingsAccessibility statement