WHY does OS X always prompt for certificate trust when connecting to WPA2 Enterprise (EAP-PEAP in my case) networks, even if the certificate is already marked as 'trusted'?

Even weirder.. if I delete the cert from keychain access, then click 'Continue' to the first cert prompt, but the click 'Cancel' on the elevation credentials window.. I am somehow still able to connect to the WiFi network...

WPA2 Enterprise Certificate Trust elevation prompt Keychain Certificat Trust


I had the same issue and my solution was to change the access control on the certificate's private key to not require confirmation. Go to My Certificates, expand your certificate, and open the private key settings. You could probably be more selective and just allow whatever "application" handles WiFi, but in my case it wasn't necessary.

enter image description here

  • 1
    My certificate is not under 'My Certificates', presumably because I don't have (and will not be given) the private key. I'm just confused why my iPhone can be told to 'trust' the darn certificate and it doesn't prompt me again, but my Mac can't do the same? Does this mean my Mac HAS to be joined to the domain? – goofology Jun 8 '16 at 21:04
  • Ah, I am using a client cert with EAP-TLS and would be prompted (like you are) each time it was used to connect. I have the actual CA loaded, not an Intermediate. Is your cert issuer trusted? If not, maybe you need to load the CA as well. – Donald Byrd Jun 9 '16 at 2:12
  • It's self signed intermediate... Hmm. Can I obtain the CA from a domain-joined PC? – goofology Jun 9 '16 at 4:50
  • If your PC is using this intermediate, it probably also has the CA. You can check using the Certificates snap-in to MMC. – Donald Byrd Jun 9 '16 at 13:29
  • well i found the root CA from my PC, Exported/Imported to mac, marked as trusted, and still am prompted. Hmm. exploring a bit more. – goofology Jun 9 '16 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .