I have set up 802.1x authentication on my wireless network with EAP-TLS. The use case here is that I would like the presence of a certificate to be both necessary and sufficient for connecting to the network. The condition is that there should be no passwords of any kind involved in any point of the authentication process.
After generating the client certificate, I used openssl 1.1 to generate a .pfx file in PKCS12 format (the server certificate is different and is signed by Let's Encrypt to avoid requiring clients to trust the server CA). I sent it to my Android device, installed it as a wifi certificate, and it worked great.
Today I had a guest come by who wanted to connect using an iPhone. They were able to download the certificate (iOS seems to call it a profile), but when they went to import it, it asked for a password. The interface would not allow them to enter a blank password, the "Install" button would be greyed out unless they typed something. We could not figure out any way to convince iOS that the certificate had no password, nor a blank password. This comment seems to indicate that doing so is not possible.
I then tried the steps mentioned in this answer which gave the same result. I tried following the steps in this question but when piping the certificates, all I got was the error
unable to load certificates. I thought
-keypbe NONE -certpbe NONE might be the important part so I regenerated the .pfx file from scratch and added those parameters, but with the same result (iPhone prompted for password). Lastly I saw in this answer the
-nomac flag, so I tried adding that, but this time the iPhone refused to load the certificate at all (errored with "Invalid Profile").
I am using openssl 1.1 to avoid any of the algorithm issues with openssl 3. How can I generate a PKCS12 container with no password that is accepted by iOS devices?