@ -97,25 +97,25 @@ To facilitate installation of the certificates, a helper script is provided, see
The script will install the certificates in the ``rsa2k`` directory to the TLS credentials store in the device over UART and using TLS credentials shell commands.
The script will install the certificates in the ``rsa2k`` directory to the TLS credentials store in the device over UART and using TLS credentials shell commands.
To initiate Wi-Fi connection using enterprise security, use one of the following commands depending on the EAP method:
To initiate a Wi-Fi connection using enterprise security, use one of the following commands depending on the EAP method:
Server certificate is also provided in the same directory for testing purposes.
Server certificate is also provided in the same directory for testing purposes.
Any AAA server can be used for testing purposes, for example, ``FreeRADIUS`` or ``hostapd``.
Any AAA server can be used for testing purposes, for example, ``FreeRADIUS`` or ``hostapd``.
@ -123,16 +123,17 @@ Any AAA server can be used for testing purposes, for example, ``FreeRADIUS`` or
Certificate requirements for EAP methods
Certificate requirements for EAP methods
----------------------------------------
----------------------------------------
Different EAP methods require different certificates on the client side:
Different EAP methods have varying client-side certificate requirements, as outlined below:
* **EAP-TLS**:
* EAP-TLS - Requires both a client certificate (and its private key) and a CA certificate on the client.
Requiresbothaclientcertificate(andprivatekey)andthe CA certificate on the client. The client authenticates itself to the server using its certificate.
The client authenticates itself to the server using its certificate.
* **EAP-TTLS-MSCHAPV2**:
* EAP-TTLS-MSCHAPV2 - Requires only the CA certificate on the client.
Requires only the CA certificate on the client. The client authenticates to the server using a username and password (MSCHAPV2) inside the TLS tunnel. No client certificate is needed.
The client authenticates to the server using a username and password <MSCHAPV2> inside the TLS tunnel.
No client certificate is needed.
* **EAP-PEAP-MSCHAPV2**:
* EAP-PEAP-MSCHAPV2 - Requires only the CA certificate on the client.
Requires only the CA certificate on the client. Like TTLS, the client uses a username and password (MSCHAPV2) inside the TLS tunnel and does not need a client certificate.
Like TTLS, the client uses a username and password <MSCHAPV2> inside the TLS tunnel and does not require a client certificate.