CONFIGURING EAP-TLS AUTHENTICATION on IOS DEVICES:
I prepared below instructions configuring IOS Clients- both iPads & iPhones- to connect to a MikroTik Router advertising an SSID requiring EAP-TLS authentication.
I've tried to make them as generic as possible. In any event, the process of installing the Certificates into "Profiles" on IOS devices should just work irrespective of how the EAP-TLS is configured on whatever Access Point you're trying to connect to.
If you wish to reference how the certificates used in the process were generated on the MikroTik- as well as how to configure the EAP-TLS Authentication on the router side using a MikroTik it is documented HERE.
The method described below requires the client certificates- which were created on a MikroTik Router in my case- for the IOS devices to be imported via HTTP/HTTPS.
(2) Certificates must be installed on each IOS device: A Client Certificate and "CA" Certificate that was used to sign it. Installing the CA cert on the IOS device with the Client cert provides a complete chain of trust enabling them to be treated as "Verified" by IOS.
NOTE: Below Process was developed and documented using IOS 12 and may vary in future IOS releases.
- Open Safari on your iPhone/iPad. Do NOT use any other web browser!! Safarai will identify them as certs and ask you to install them.
- Enter IP where the IOS Client certificates live. In my case this was the IP of the MikroTik router's WebGUI
- Navigate to where your certs live. In my MikroTik's menu, I clicked "Files" to get the IOS Client certificates
- Download the CA Certificate: "cert_export_CAF1Linux.crt" NOTE the ".crt" file extension. Do NOT download the ".p12" cert for the CA cert!!!!
- Now navigate to: Settings > General > Profiles
- Click the CA certificate. In my example this was "CAF1Linux"
- Click "Install" at top right corner of screen
- Accept both the warning about the profile not being signed and subsequent warning about giving the CA cert root trust perms.
- You'll be prompted for the device's 6 digit pass code; enter it
- Click "Install" again to accept allow installation to proceed
- Enter the export password when it the certificate was exported to install it
- Click "Done" in top right corner of screen
- NOTE: Cert will report a status of "Not Verified" after completing setup. Press "Profiles", choose the cert and it should now report "Verfified" with green tick next to it.
- Repeat steps to install the client certificate after the CA cert has been installed successfully.
After installing BOTH certs, their status should report "Verified".
Unless you see "Verified" next to the certificates/profiles, you will nto be able to successfully make an EAP-TLS connection.