0

I'm on a location that has a 802.1x / WPA3-Enterprise WiFi connection using PEAP / MSCHAPv2 authentication. I only know the identity (username) and password.

I can connect with all my devices: my Macbook, an older Android phone, my iPad. Except my Android 11 phone also requires a "domain":

Android 11 requires a domain

Note that all other devices don't require this, they can connect just fine with only the identity and password.

I am completely clueless what to fill in here. There is no system administrator or IT I can contact. Since the other devices can connect without any domain, I figured it must somehow be possible to derive the domain from the certificate.

If I look into recent certificates on my MacOS it shows a 'Vigor Router' certificate for this WiFi connection. If I look into the certificate details, I see this:

Certificate details on MacOS

I don't see any domain name. I found sometimes a domain is entered into the Common Name (CN) field, which is Vigor Router in this case. If I fill that in for domain it doesn't work. Also tried draytek.com and www.draytek.com in case it's some standard certificate setting (this Vigor Router is from Drayek) but no go either.

Upon searching I also noticed it may be the 'FQDN' field but I don't see any such field (or anything that looks like a domain) in the certificate details.
Other workarounds I found involved installing a different certificate on the 'RADIUS server' but I am clueless as to what that is, and more importantly I don't have access to any router or server here. I can only connect as a regular network user.

Is there a way to figure out what I have to specify for 'domain' to connect on Android 11?

P.S. I realize this was changed since Android 11 for security reasons, and that the way the other devices do it is actually insecure. For practical means and purposes, in this particular case I don't care about security - I just need to connect no matter what.

1 Answer 1

1

You can indeed find the correct domain in the network's certificate (PEAP uses regular TLS certificates that would have it either in the CN or SAN), but having the device automatically take it from there would rather defeat the whole point of domain verification.

The reason other devices are able to connect isn't because they derive the domain from the certificate – it's because they don't bother looking for it in the first place. (Android did no verification, iOS remembers the exact certificate.) Which, unfortunately, implies that the certificate might not even have a valid domain in the first place.

(But if it had one, it'd be on the "server" certificate, not on the "root" certificate.)

However, domain verification is only truly needed when the network is using a public TLS CA (e.g. DigiCert or such) for its certificates.

Your network seems to be using an internal CA, which (even if it's a garbage CA autogenerated by the router) still makes it a quite different situation – as long as random people cannot obtain TLS certificates from it, you're fine with trusting the CA as a whole.

You should be able to export the CA root certificate from macOS and import it into your Android device as a "Wi-Fi CA". It should then show up as an option instead of your current "Use system CAs" selection, and choosing it should make the Domain field optional.

7
  • Thanks a lot, I tried exporting the self-signed root CA from macOS, I've got a .cer file (also converted that to .pem and .crt just in case), copied those to my Android phone, and tried to import it there as a WiFi CA. Unfortunately it says "private key required to import certificate" (tried all 3 formats). Am I exporting it incorrectly? I just right-click the Vigor Router certificate in macOS' Keychain Access app and choose Export Certificate (I don't see any options related to keys or encryption there). Or is it somehow automatically using some private key from my macOS environment?
    – Rog
    Commented Aug 22, 2022 at 3:56
  • 1
    Ah right, current Android seems to have separate "CA cert" and "Wi-Fi cert" options – in this case you want to select the former instead. Commented Aug 22, 2022 at 3:59
  • Thanks, just wanted to add I tried that as well, but unfortunately I get the same message there too: private key required to install certificate. Can I somehow export it differently, or convert it to a different format, so that doesn't require a private key on Android 11? I don't have the private key as far as I know (I assume only the router will have it) but since macOS can install the CA, logically Android should be able to install it as well?
    – Rog
    Commented Aug 22, 2022 at 4:18
  • 1
    The "CA certificate" option should not require a private key. I'm pretty sure I've installed CAs from .crt files without a user keypair included. It could be that Android is not recognizing the router's certificate as a CA because it's not actually marked as one through its extensions (being self-signed only kind of makes it a CA, but it's got the extension fields of a TLS end-host certificate). Commented Aug 22, 2022 at 4:25
  • 1
    Android is not asking for the CA's private key here – it's not understanding that you're in fact trying to import a CA in the first place. It expects a private key because it thinks you're importing a "user" certificate. (My Android 12 phone seems to allow importing Wi-Fi CA certificates from the "PEAP details" screen, but your screenshot doesn't look like it has the selection active at all.) Commented Aug 22, 2022 at 13:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .