How to install and trust a 802.1x Radius certificate on the iOS device programmatically

Question

SJose OP

Created Jul ’22

Replies 3

Boosts 0

Views 1.4k

Participants 2

Hi,

In our project we have a device which will provide a secure access point(wifi and ethernet) and it is using a 802.1x Radius server authentication system. In order for the iOS devices to be network trusted in 802.1X, the root and intermediate CAs must be installed in iOS device.

How can this be done programmatically in swift without sharing the user a link with the trusted certificate to the iOS devices and asking user to manually trust it from Certificate Trust Settings.

Can I add the certificate to the list of trusted anchors using SecTrustSetAnchorCertificates(_: _:).

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’22

Are you in a managed environment?

Most folks in this situation are working in a managed environment, and thus they install the Wi-Fi configuration and its associated credentials using MDM.

Oh, or by this:

In our project we have a device

do you mean a Wi-Fi based accessory?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

SJose OP

Jul ’22

@eskimo In developer document it is mentioned setTrustedServerCertificates(_:)

Sets trusted EAP server certificates for an enterprise Wi-Fi or Hotspot 2.0 network. Can I make use of this function for my scenario?. The app I am working on is for common users and not for any restricted group.

The accessory which I am working will provide a wifi point to which any iOS device with installed radius certificate should be able to.join without any authentication.

So through my IOS app I need to install and trust this certificate.

Once joined to the wifi even though app is killed the device should still connected to the SSID

0

Answer 3

DTS Engineer OP

Apple

Jul ’22

this is a portable accessory

OK.

On iOS you can add Wi-Fi configurations using NEHotspotConfigurationManager. That API supports various security options, including EAP (via NEHotspotEAPSettings). The EAP support does let you override the server trust evaluation done by the client device using the setTrustedServerCertificates(_:) method that you mentioned.

That can be tricky to get working but, based on this thread, I believe it should work on current systems.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0