I've put together this luci app which implements a complete WPA2-Enterprise authentication backend. It provisions a dedicated RADIUS instance and a web interface to provision certificates.
Just enter the IP of the access point in the web config, copy the shared secret to the access point via it's web interface, add the IP of the router and port to the access point and it should immediately work.
Use the web UI on the router to make a certificate for each device you want to use, download it and install it on the device. No username. The password protecting the certificate is displayed on the web UI.
Available as an .ipk for manual download and installation.
Be aware that everything in OpenWrt has been moved away from luci-compat, nothing new depending on it will be merged anymore - and the factual removal merely depends on someone actually pulling the plug.
At this point in time, what I would appreciate in terms of feedback are 'it works for me' type comments.
My time and resources are not infinite; I will refactor when I have the time. I'm not asking the maintainers to pick it up. I just wrote this for my own purposes because passwords suck and I've been meaning to implement client certificate wifi for a long time.
I think adoption of your new app would be much higher if it were designed for newer versions of OpenWrt and an APK package were provided as well. You will get a lot more feedback.
At this point in time, what I would appreciate in terms of feedback are 'it works for me' type comments.
Well, according to screenshots, it is entirely focused on certificate-based authentication, which is not my use case. I still love usernames and passwords, as they are easy to enter on mobile phones. My WPA3-Enterprise deployment offers PEAP and EAP-TTLS with MSCHAPv2.
@Lascaille wants EAP-TLS, which is widely regarded as the most secure EAP authentication method because it uses certificate-based mutual authentication. It is a real security improvement over EAP-TTLS and PEAP.
The other thing about passwords is, it confuses the user. They have to select between PAP, CHAP, MS-CHAP, etc. Every device tries a different standard. Windows laptops will try them all, I have no idea what iPhones do, etc. Users forget them, ask you to change them, want to change them, etc. Issuing and managing credentials is an absolute mess and a time sink. If you create a web UI for users to self-manage their credentials that's another thing you have to administer and secure.
With certificates there's only one workflow, you add the cert and trust it. They only need to use the certificate password when trusting or installing it, then it's stored in their device's security keychain. From that point on it just works.
Certs also have an expiry date so if you're incredibly security conscious you can issue 10 day certs and know that whatever happens, your authentication will self-seal.
This is something I'm putting together specifically to make it absolutely trivial to implement WPA-Enterprise with client certificates, which is the most secure solution at the moment.
If you have different requirements then this won't be for you. If you're already operating a central authentication database of some sort you've already solved this problem.
I've just got the 25.12 SDK to cooperate (had to change the build VM) and the build is running. Will need to fiddle with a few things I expect but apk files are on the way.
Right we went through a few iterations here as some bugs came out and then I decided that we only needed one module, as there are no binary components.
Updated the release (and bugged it, and updated it again.)
Know that's not the proper way to do it but didn't want to have to re-create all the links. There should now be a 'Download CA' button above the certificate list.
On Windows you need to download the CA and add it to the 'Local Machine -> Trusted Root Certificate Authorities' store (don't let it automatically pick a store) and then add the user certificate to the 'Local User -> Personal' store.
Once you have those added you can connect to the SSID and the default setting of 'smartcard or certificate' just works.
