I just watched this video https://www.offensive-security.com/penetration-testing/hacking-wpa-enterprise-with-kali-linux/ and the authors readily admit that the title is click-bait but I am still wondering what is going on.
Shouldn't there be a certificate warning on the phone? (Edit: This may indeed not have anything to do with the protocol and be just a client issue. There could however have been some other problem that allows them to fake a valid certificate.)
Why is the password so easily retrieved from the challenge response messages? (Has that been fixed in WPA2?)