Android recently got an update which prevents you from connecting insecurely to WPA Enterprise networks.
The IT staff for SRVUSD firmly insisted that it is now simply impossible to connect an Android phone to the SRVUSD-BYOD network.
I didn’t believe them, so I brought my laptop to school, used Wireshark to dump the WPA handshake,
and found the certificate information that is needed to connect securely.
I am writing this tutorial because the district’s own IT staff can’t help students figure this out,
so hopefully I can.
The tutorials provided here detail how to connect to the SRVUSD-BYOD network
securely (i.e. with certificate verification). There are also ways to connect
insecurely (i.e. without certificate verification), but that’s insecure, so you
shouldn’t do that.
Note: the steps below are for stock Android. If your phone uses modified
Android (like some Samsung phones), the exact steps may differ. The general
process will stay consistent, though.
The process to connect on Android consists of two main steps: (1) install the
SRVUSD Root CA certificate, and (2) configure the network.
Important note: This only installs the SRVUSD Root CA certificate for
verifying Wi-Fi networks. It cannot verify websites, so it does not
compromise the security of your device.
First, download the SRVUSD Root CA
Certificate. Make sure the file ends with
.crt or .cer. Android might not recognize it otherwise. (If you don’t trust me, download and extract
the certificate from srvusd.net/pki)
Navigate to Wi-Fi Preferences. This can be found in Settings > Network
& internet > Wi-Fi > Wi-Fi Preferences.
Select Advanced > Install certificates.
Select the certificate file. You can name it whatever you want. I simply
named it SRVUSD-RootCA.
Go back to the Wi-Fi settings and select the SRVUSD-BYOD network. (Or add a network with the SSID SRVUSD-BYOD and select
WPA/WPA2/WPA3-Enterprise security.)
Enter the details accordingly:
Field name
Value
EAP method
PEAP
Phase 2 authentication
MSCHAPV2
CA certificate
Select the name of the certificate you just installed
Online Certificate Status
Either “Do not validate” or “Request certificate status”
Domain
srvusd.k12.ca.us
Identity
students\######, where ###### is your student ID number
If using the GUI connection editor (nm-connection-editor), add a new Wi-Fi
network and fill out the fields with the information provided
above. See the screenshots below
for details.
For the CA certificate, download (or create) the certificate file. Then select
that file as the CA certificate in the connection editor, or provide the path
in the connection configuration file.
## /etc/NetworkManager/system-connections/SRVUSD-BYOD.nmconnection[connection]id=SRVUSD-BYODtype=wifi[wifi]mode=infrastructuressid=SRVUSD-BYOD# Randomize MAC address (limits device tracking)#cloned-mac-address=random[wifi-security]key-mgmt=wpa-eap[802-1x]ca-cert=<path to SRVUSD CA certificate>domain-suffix-match=RADIUS-DC2.srvusd.k12.ca.useap=peap;phase2-auth=mschapv2identity=students\\####### Password flags:# 1 - Save password in user agent (not system-wide)password-flags=1[ipv4]method=auto[ipv6]method=auto#addr-gen-mode=stable-privacy
Below are the three PEM-encoded X.509 certificates in the trust chain for the
SRVUSD-BYOD network.
Note: the URLs provided in the certificates (e.g. CRL distribution
points) no longer exist. Thus you should not enable CRL or OCSP checking when
using these certificates.
