11

WHY does OS X always prompt for certificate trust when connecting to WPA2 Enterprise (EAP-PEAP in my case) networks, even if the certificate is already marked as 'trusted'?

Even weirder.. if I delete the cert from keychain access, then click 'Continue' to the first cert prompt, but the click 'Cancel' on the elevation credentials window.. I am somehow still able to connect to the WiFi network...

WPA2 Enterprise Certificate Trust elevation prompt Keychain Certificat Trust

Improve this question

2 Answers 2

Reset to default
9

I had the same issue and my solution was to change the access control on the certificate's private key to not require confirmation. Go to My Certificates, expand your certificate, and open the private key settings. You could probably be more selective and just allow whatever "application" handles WiFi, but in my case it wasn't necessary.

enter image description here

Improve this answer
6
  • 1
    My certificate is not under 'My Certificates', presumably because I don't have (and will not be given) the private key. I'm just confused why my iPhone can be told to 'trust' the darn certificate and it doesn't prompt me again, but my Mac can't do the same? Does this mean my Mac HAS to be joined to the domain?
    – goofology
    Commented Jun 8, 2016 at 21:04
  • Ah, I am using a client cert with EAP-TLS and would be prompted (like you are) each time it was used to connect. I have the actual CA loaded, not an Intermediate. Is your cert issuer trusted? If not, maybe you need to load the CA as well.
    – Donald Byrd
    Commented Jun 9, 2016 at 2:12
  • It's self signed intermediate... Hmm. Can I obtain the CA from a domain-joined PC?
    – goofology
    Commented Jun 9, 2016 at 4:50
  • If your PC is using this intermediate, it probably also has the CA. You can check using the Certificates snap-in to MMC.
    – Donald Byrd
    Commented Jun 9, 2016 at 13:29
  • well i found the root CA from my PC, Exported/Imported to mac, marked as trusted, and still am prompted. Hmm. exploring a bit more.
    – goofology
    Commented Jun 9, 2016 at 16:50
4

I believe what's happening is that macOS needs access to the private key of the client certificate that EAP TLS is requesting. As has been suggested, find the client certificate in Keychain Access (if the prompt you get states that it is trying to access the "System" keychain, then search in the System keychain).

Beside the certificate there will be an arrow that allows you to expand the hierarchy, exposing the private key associated with the certificate. Expand then double-click on the key. Select Access Control.

Now if you're like me and you don't want to allow all applications to access this key, you'll need to select the eapolclient. Click the "+" symbol, then Command+Shift+G and enter "/System/Library/SystemConfiguration/EAPOLController.bundle/Contents/Resources". Click "Go". Select eapolclient and click "Add", then authenticate yourself. Oddly enough, although this gives permission to eapolclient, revisiting the Access Control dialog doesn't show the newly added eapolclient.

NB: I'm running Mojave 10.14.6.

Improve this answer
1
  • Awesome, explanation makes perfect sense, solution works (on Big Sur as well). Thanks a lot!
    – Toby
    Commented Sep 11, 2022 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .