EDUROAM explanation
eduroam (the cross-institution wifi system) moved from a login based authentication system to a certificate based system in early 2022. For anyone using manual wpa_supplicant configurations, it is non-obvious how to interface with this new system.Getting certs and keys
You will first need to get a valid certificate and private key from UW. Go to UW IT's eduroam-tls page, and select "User-Defined" so that it will just generate a cert, rather than a binary. Randomly generate a high-quality password for the private key, and store somewhere for later. Save the certificate asClient_cert.p12.
Once at the final page, also download the CA cert (save as CA_cert.pem).
p12 (pkcs12) is not a helpful format, since wpa_supplicant cannot parse it, so we need to extract the key and cert.
openssl pkcs12 -in Client_cert.p12 -out tmp_cert -clcertstmp_cert and save to
separate files (Client_cert.pem and Client_key.key). You only
need the blocks deliniated by "-----BEGIN CERTIFICATE-----" to
"-----END CERTIFICATE-----" and similar for the
key. Discard the rest.
Writing a wpa_supplicant config
My config is then as follows, modify only the lines with a*:
network={
ssid="eduroam"
scan_ssid=1
key_mgmt=WPA-EAP
eap=TLS
phase2="auth=PAP"
identity="anonymous@uw.edu"
* ca_cert="FULL_PATH_TO/CA_cert.pem"
* client_cert="FULL_PATH_TO/Client_cert.pem"
* private_key="FULL_PATH_TO/Client_key.key"
* private_key_passwd="PASSWORD_YOU_CHOSE_EARLIER"
}