I can not connect to Wi-Fi 802.1x using AD Certificate Authentication.

[Samdy]

Anyone can help me I can not connect to Wi-Fi 802.1x using AD Certificate Authentication.
Here is configuration file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array> <dict> <key>PayloadCertificateFileName</key> <string>ca0101.sabay.office_Sabay Subordinate CA 1</string> <key>PayloadContent</key> <data>MIIFKDCCAxCgAwIBAgITGAAAAAVt2M2Tbx6nrQAAAAAABTANBgkqhkiG9w0BAQ0F ADBCMQswCQYDVQQGEwJLSDEbMBkGA1UEChMSU2FiYXkgRGlnaXRhbCBDb3JwMRYw ..................................................................................................................................................................................
</data> <key>PayloadDescription</key> <string>Sabay Subordinate CA 1 Certificate</string> <key>PayloadDisplayName</key> <string>Sabay Subordinate CA 1</string> <key>PayloadIdentifier</key> <string>com.sabay.cacertificate.ca0101</string> <key>PayloadType</key> <string>com.apple.security.root</string> <key>PayloadUUID</key> <string>9768C058-9437-4F51-B7E6-AEAEF9717531</string> <key>PayloadVersion</key> <integer>1</integer> </dict> <dict> <key>PayloadCertificateFileName</key> <string>ca01.sabay.office_Sabay Root CA</string> <key>PayloadContent</key> <data>MIIFXzCCA0egAwIBAgIQPiI44o7JSJFNMEoBDNEOxDANBgkqhkiG9w0BAQ0FADBC MQswCQYDVQQGEwJLSDEbMBkGA1UEChMSU2FiYXkgRGlnaXRhbCBDb3JwMRYwFAYD VQQDEw1TYWJheSBSb290IENBMB4XDTE2MDgxNzA3MDczMFoXDTM2MDgxNzA3MTcy .................................................................................................................................................................................. </data> <key>PayloadDescription</key> <string>Sabay Root CA Certificate</string> <key>PayloadDisplayName</key> <string>Sabay Root CA</string> <key>PayloadIdentifier</key> <string>com.sabay.cacertificate.ca01</string> <key>PayloadType</key> <string>com.apple.security.root</string> <key>PayloadUUID</key> <string>65295CEA-70C9-431A-86D1-F5581F2FED4F</string> <key>PayloadVersion</key> <integer>1</integer> </dict>
<dict> <key>PayloadCertificateFileName</key> <string>ca0102.sabay.office_Sabay Subordinate CA 2</string> <key>PayloadContent</key> <data>MIIGQzCCBCugAwIBAgITGAAAAATMtBiO2u3hygAAAAAABDANBgkqhkiG9w0BAQ0F ADBCMQswCQYDVQQGEwJLSDEbMBkGA1UEChMSU2FiYXkgRGlnaXRhbCBDb3JwMRYw FAYDVQQDEw1TYWJheSBSb290IENBMB4XDTE2MDgyNDE1MDExOVoXDTI2MDgyNDE1 ..................................................................................................................................................................................
</data> <key>PayloadDescription</key> <string>Sabay Subordinate CA 2 Certificate</string> <key>PayloadDisplayName</key> <string>Sabay Subordinate CA 2</string> <key>PayloadIdentifier</key> <string>com.sabay.cacertificate.ca0102</string> <key>PayloadType</key> <string>com.apple.security.root</string> <key>PayloadUUID</key> <string>CE70721D-DBC5-44B5-92AA-CAEEE78BA944</string> <key>PayloadVersion</key> <integer>1</integer> </dict> <dict> <key>EAPClientConfiguration</key> <dict> <key>AcceptEAPTypes</key> <array> <integer>13</integer> </array> <key>PayloadCertificateAnchorUUID</key> <array> <string>9768C058-9437-4F51-B7E6-AEAEF9717531</string> <string>65295CEA-70C9-431A-86D1-F5581F2FED4F</string> </array> </dict> <key>EncryptionType</key> <string>WPA</string> <key>HIDDEN_NETWORK</key> <true/> <key>Interface</key> <string>BuiltInWireless</string> <key>PayloadCertificateUUID</key> <string>0EF3981E-0DD8-4A62-A792-A859E734DCB6</string> <key>PayloadDescription</key> <string>EAP-TLS 802.1x configuration</string> <key>PayloadDisplayName</key> <string>Sabay Office</string> <key>PayloadIdentifier</key> <string>com.apple.eaptls.8021x.wifi</string> <key>PayloadOrganization</key> <string>Sabay Digital Corp</string> <key>PayloadType</key> <string>com.apple.wifi.managed</string> <key>PayloadUUID</key> <string>9574A054-8A51-46B3-8766-D8542DB0D843</string> <key>PayloadVersion</key> <integer>1</integer> <key>SSID_STR</key> <string>Wi-Fi</string> <key>SetupModes</key> <array> <string>System</string> </array> </dict> <dict> <key>CertServer</key> <string>http://request_Certificate_URL/certsrv</string> <key>CertTemplate</key> <string>Sabay-WorkstationAuthentication</string> <key>UserName</key> <string></string> <key>Password</key> <string></string> <key>PromptForCredentials</key> <false/> <key>ADCertServerCertificateIDReplySearchString</key> <string>YOUR_CERT_ID_REPLY_SEARCH_STRING_HERE_OPTIONAL</string> <key>PayloadDisplayName</key> <string>Computer Certificate</string> <key>PayloadIdentifier</key> <string>com.apple.ADCertificate.managed</string> <key>PayloadType</key> <string>com.apple.ADCertificate.managed</string> <key>PayloadUUID</key> <string>D275DE5A-5BD7-4594-B16D-F697BC58ED28</string> <key>PayloadVersion</key> <integer>1</integer> <key>deleted</key> <false/> </dict>
</array>
<key>PayloadDescription</key>
<string>EAP-TLS 802.1x configuration</string>
<key>PayloadDisplayName</key>
<string>Sabay Office</string>
<key>PayloadIdentifier</key>
<string>com.sabay.ADCertificate.managed</string>
<key>PayloadOrganization</key>
<string>Sabay Digital Corp</string>
<key>PayloadRemovalDisallowed</key>
<true/>
<key>PayloadType</key>
<string>SystemConfiguration</string>
<key>PayloadUUID</key>
<string>78BB1EE4-EC9E-463A-86D7-00DA73F26733</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

And after install this .mobileconfig and tried to connected Wi-Fi is was need Username:

[mark_mahabir]

Are you including the relevant certificates in the profile?

Does anything here help? We based our Config Profile on the recipe there.

[Samdy]

In my environment using PEAP to authenticate with computer Certificate that request from AD.
Now I can request certificate computer from AD, but the most of problem is configure .mobileconfig Wi-Fi to make it authenticated with certificate using PEAP EAP-TLS.
So anyone have .mobileconfig file that using PEAP authenticate with certificate? Or have and idea about this?
Help me please 😃
Thanks,

[MSR]

We just went through this ourselves, I feel for you.

What kind of certificate template are you using from your AD? Did you make sure that the UPN and not the SPN trait is selected in the template?

If you have a UPN certificate, then you're most likely missing a certificate from one of your chains. Ensure that you have all the certs in your keychain for both your domain AND the server that you're attempting to authenticate to. From what it looks like above, you only have your domain controller and a subordinate CA. In our environment, we're connecting to an Aruba controller and there was a chain of 3 certificates that needed to be added.

It also looks like you're missing the username attribute. We set ours at $COMPUTERNAME, but I've heard different stories.

Lastly, the article that mark.mahabir posted is good, but it looks like apple removed the eapolclient log from newer versions of Mac OSX. Get a Mavericks machine and try. It'll tell you exactly what's wrong.

[Samdy]

Thanks for the reply !
Did you have mobileconfig file?