Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand you cannot use EAP-TLS for public wifi because the clients will not have their own certificates, therefore what EAP do you use, so that mutual authentication can take place?

share|improve this question
Please define mutual in the context of public Wi-Fi. What are you actually trying to do? – haimg Jan 22 '12 at 22:31

I'm assuming that you want clients to connect with passwords. You want to use either PEAP or EAP-TTLS with MSCHAPv2 as the inner authentication method. You will probably still need to provide clients with a CA certificate to verify the server with.

share|improve this answer

PEAP with MSCHAPv2 is the most compatible. Except Windows desktops, all other devices directly connect and prompt you for the username / password. You don't need a trusted server certificate; it can be self signed.

On Windows, you will need to manually create the connection and disable server certificate trust verification, or get a certificate from a trusted CA. This is not the same trust store as the browser and has a much more limited set of root CAs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.