I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS.

I have therefor created a user certificate and a user within the FreeRADIUS user management (including password). The certificates CN field matches the username. Then I converted the certificate/key into a password-protected #PCKS12 container and installed it on my iOS devices (where it is being called profile).

When setting up the WLAN connection on my iPhone 5 it asks me for a profile and a username. But i never get asked for a password.

My security-protocol knowledge is limited and I don't understand why I don't have to enter a password when accessing my WLAN (or at least when setting it up). The only time I had to enter a password was when I was installing the certificate, which I guess is only used to decrypt the keys and certificate.

Currently I am thinking of EAP-TLS as a two-factor authentication consisting of username/password and a private key (certificate).

So is there something wrong in the way I configured FreeRADIUS or do I have a wrong understanding on how EAP-TLS works and what it provides?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.