How to connect to the WPA2 EAP-TLS network

Create certificates

You need to create/use a certificate to connect to the WPA2 access point.

 ## connect to wpa-01.in.metalab.at (10.20.30.25) as root.
 # user@host:~# ssh -l root wpa-01.in.metalab.at
 # root@wpa-01:~# cd /ca
 # root@wpa-01:~# ./mkclient.sh yourname
 ## enter ca password
 ## choose secretpassword for your key file
 ## choose import/export password
 # root@wpa-01:~# exit
 ## copy the certificates to your host
 # user@host:~# scp -r root@wpa-01.in.metalab.at:/ca/users/yourname /path/to

You are now able to connect to the network by using the ca and your client certificate.

Use certificates

Linux

sample wpa_supplicant.conf:

 network={
   ssid="metalab-wpa2"
   scan_ssid=1
   key_mgmt=WPA-EAP
   proto=WPA2
   eap=TLS
   pairwise=CCMP
   group=CCMP
   identity="yourname"
   ca_cert="/path/to/ca.crt"
   client_cert="/path/to/yourname-cert.pem"
   private_key="/path/to/yourname-key.pem"
   private_key_passwd="secretpassword"
 }

MacOS X

Import the ca-certifcate "ca.crt" to the system keychain.

Set the trust level for the ca-certificate

Import the client certifcate "yourname-cert.p12" to the login keychain with the choosen import password.

Connect to the metalab-wpa2 network

Windows

tbd

Revoke certificate

 ## connect to wpa-01.in.metalab.at (10.20.30.25) as root.
 # user@host:~# ssh -l root wpa-01.in.metalab.at
 # root@wpa-01:~# cd /ca
 # root@wpa-01:~# ./revoke.sh yourname
 ## enter ca password