Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS?
In essence, we want to provide an open wifi network, but want to ensure users cannot see each other's traffic. With WPA2-PSK, this appears to be impossible. As users are expected to have our app installed, the option we were thinking of is using WPA-EAP. Since WPA2-EAP-PSK is unsupported by almost every device, we were looking for an alternative. EAP-WPA2-TLS seems to be an option, the question is: Can we deliver every client the same certificate, or do we need to ensure each client has their own certificate? Authentication is not a concern, this is only relevant for data security.
It appears that the PTKs are generated using the certificate, but I'm unable to determine if that is the only source or if other data is used to generate the keys that would still guarantee unique encryption keys.