2

I try to connect an iPad (iOS 11.3.1) to a WiFi network which uses EAP-TLS. There is no way to specify EAP-TLS mode because of the lack of the certificate, so I need to import the certificate first.

I copied the client certificate to the device, and now, I want to install it. According to a few websites I checked, it seems to be easy:

Open the certificate file on the device. IOS will recognise the file as a certificate file, and begin the import process. Tap install.

Source

All Apple iPads and iPhones support PKCS1-formatted X.509 certificates, stored in files ending with .crt, .cer, .pem or .der.

Source

However, I'm clueless as what exactly I should do once I downloaded the certificate file on the tablet. It allows me to do a bunch of actions such as store it in Google Drive, but there is nothing which could look like an import tool, and it doesn't look like the device recognized the PEM file.

What should I do to make the device recognize PEM certificates?

1

CONFIGURING EAP-TLS AUTHENTICATION on IOS DEVICES:

I prepared below instructions configuring IOS Clients- both iPads & iPhones- to connect to a MikroTik Router advertising an SSID requiring EAP-TLS authentication.

I've tried to make them as generic as possible. In any event, the process of installing the Certificates into "Profiles" on IOS devices should just work irrespective of how the EAP-TLS is configured on whatever Access Point you're trying to connect to.

If you wish to reference how the certificates used in the process were generated on the MikroTik- as well as how to configure the EAP-TLS Authentication on the router side using a MikroTik it is documented HERE.

PROCESS OVERVIEW:

The method described below requires the client certificates- which were created on a MikroTik Router in my case- for the IOS devices to be imported via HTTP/HTTPS.

(2) Certificates must be installed on each IOS device: A Client Certificate and "CA" Certificate that was used to sign it. Installing the CA cert on the IOS device with the Client cert provides a complete chain of trust enabling them to be treated as "Verified" by IOS.

PROCESS:

NOTE: Below Process was developed and documented using IOS 12 and may vary in future IOS releases.

  1. Open Safari on your iPhone/iPad. Do NOT use any other web browser!! Safarai will identify them as certs and ask you to install them.
  2. Enter IP where the IOS Client certificates live. In my case this was the IP of the MikroTik router's WebGUI
  3. Navigate to where your certs live. In my MikroTik's menu, I clicked "Files" to get the IOS Client certificates
  4. Download the CA Certificate: "cert_export_CAF1Linux.crt" NOTE the ".crt" file extension. Do NOT download the ".p12" cert for the CA cert!!!!
  5. Now navigate to: Settings > General > Profiles
  6. Click the CA certificate. In my example this was "CAF1Linux"
  7. Click "Install" at top right corner of screen
  8. Accept both the warning about the profile not being signed and subsequent warning about giving the CA cert root trust perms.
  9. You'll be prompted for the device's 6 digit pass code; enter it
  10. Click "Install" again to accept allow installation to proceed
  11. Enter the export password when it the certificate was exported to install it
  12. Click "Done" in top right corner of screen
  13. NOTE: Cert will report a status of "Not Verified" after completing setup. Press "Profiles", choose the cert and it should now report "Verfified" with green tick next to it.
  14. Repeat steps to install the client certificate after the CA cert has been installed successfully.

After installing BOTH certs, their status should report "Verified". Unless you see "Verified" next to the certificates/profiles, you will nto be able to successfully make an EAP-TLS connection.

  • 1
    My personal thanks not only for answering the question, but also for making the effort to document, step by step, the procedure. I hope it would be helpful for other people who are looking for more wireless security for their iOS devices. – Arseni Mourzenko Oct 1 at 18:55
  • It's my pleasure to help fellow geeks bud! I think I have some screenshots from when I did this. If I can find them I'll insert them in the answer in the appropriate places. – F1Linux Oct 1 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .