Certificate-based Wi-Fi for Macs

Getting a Mac onto certificate-secured Wi-Fi takes three things: the network’s settings, trust in the CA behind the RADIUS server’s certificate, and a client certificate that the Mac uses for that network. On a Mac that runs the Skyrsoft CertOps agent, a setting on its device group delivers them. The agent installs the Mac’s machine certificate and fetches a configuration profile with the network settings and the CAs to trust (the CertOps issuing CA, plus any you add), then binds the certificate to the SSID so that nobody has to choose one when the Mac first joins. Authentication is EAP-TLS.

The step CertOps cannot do on the Mac is the install. macOS makes a person approve a configuration profile, so each Mac shows a notification and a local administrator approves the profile in System Settings. It is not installed silently. Once it is approved, and the RADIUS side is set up as described below, the Mac can join the network with its machine certificate. There is no licence gate: the feature works the same on Free and Pro.

How it works

Turning it on

Edit the device group the Macs belong to, tick Deliver a macOS configuration profile and enter the SSID. The group then shows a macOS profile badge in the device group list. Any group can carry the setting and only its Macs act on it; a Windows machine in the same group ignores it. A device belongs to exactly one group, so a Mac has one managed Wi-Fi network.

The Macs get their machine certificate the way any agent does, from the group’s machine template. Certificate enrolment agents covers how an agent enrols.

What the agent does on the Mac

At each heartbeat CertOps tells the agent which profile its group expects: an identifier, a UUID and the SSID. Every 60 seconds the agent asks macOS for the installed configuration profiles. If one with that identifier and UUID is installed, there is nothing to do. If not, and someone is logged in at the Mac, the agent downloads the profile from CertOps over its own mTLS identity, which only ever serves a device its own profile. It saves the file in the agent’s profiles folder under /Library/Application Support/Skyrsoft/CertOps/Agent/ and opens it. macOS lists the profile as Profile Downloaded and shows a notification.

The profile is a device-level profile. It contains:

• the issuing CA’s chain, in which only the root is a trust anchor and any intermediates are installed without being trusted in their own right;
• any additional CAs you added, every one of them a trust anchor;
• the Wi-Fi network: the SSID, the security type, the auto-join and hidden-network settings, and EAP-TLS as the only authentication method, validating the RADIUS server’s certificate against those trust anchors;
• a setting that stops the Mac offering the person a trust exception for the RADIUS server’s certificate.

It contains no client certificate and no private key; the agent handles those. Each trust anchor is installed on every Mac that approves the profile, so treat the CA settings with the care you would give any change to a trust store.

What the person approves

A local administrator opens System Settings → General → Device Management, selects the downloaded profile, clicks Install and authenticates. Someone who is not an administrator can only approve it by entering an administrator’s credentials. macOS enforces this step and nothing the agent runs can do it for them. macOS labels the profile Not Signed, because CertOps does not sign it.

The agent asks once and then reminds the person at most every 24 hours, up to three times. A reminder is spent only when the agent reaches someone. With nobody logged in, or if the download or the open fails, the agent tries again later without using one up. After the third reminder it stops asking and the profile stays pending until someone approves it. If an installed profile is removed later, the agent offers it again with a fresh set of reminders.

The certificate

The certificate the Mac presents is its machine certificate: the one the agent enrols under the group’s machine template and keeps in the System keychain. It is not a user certificate and it does not go into a login keychain. Once that certificate is in the System keychain as an identity, the agent, running as root, sets the macOS identity preference for the SSID to that certificate, using the thumbprint read from the certificate itself. The identity preference is macOS’s record of which certificate a network should use, and it is what lets the Mac join without anyone choosing one.

Renewal and changes

The profile does not refer to the Mac’s certificate, so renewing the machine certificate does not touch it and there is nothing to approve again. The new certificate has a new thumbprint, and on its next check the agent points the SSID’s identity preference at it.

A profile’s UUID comes from its contents, and the agent asks for approval whenever the UUID CertOps announces is not the one installed on the Mac. These changes alter the contents, so each one gives every Mac in the group a new profile to approve:

• the SSID or any other setting in the group’s macOS profile section, including the additional CAs;
• the group’s name;
• the issuing CA, which comes from the group’s machine template (or from the default CA if the template names none), and a replacement of the certificate of any CA the profile carries;
• the licensee name the profile carries. Free capability carries none, so any move between Free and Pro (activating a licence, or a licence reverting to Free) and any change of licensee name changes the profile.

Other group settings, such as its membership rules, do not.

Settings

All of these are on the device group’s form.

When you read a CA from a server, the console shows its fingerprint so you can check it against a value you obtained separately. Every additional CA is pinned as a trust anchor, intermediates included.

Some things are fixed. The authentication method is EAP-TLS, with no username or password field, because the certificate supplies the identity. The profile never allows trust exceptions and carries no proxy setting, and an administrator can remove it at any time.

What the RADIUS side needs

Two settings on the RADIUS side are easy to miss, and a Mac that has the profile cannot join without them.

Without the RADIUS server’s CA, the Mac cannot validate the server. Add the CA that signed the server’s certificate under Additional trusted CAs (often an AD CS CA), and fill in the trusted server names. Trusting a CA alone means the Mac accepts any server certificate that CA issued, so anything else holding one could stand in for the RADIUS server; naming the server narrows that.

On Windows NPS the machine certificate has to carry an Active Directory identity. The group’s machine template must be bound to your Active Directory domain, and the Mac’s computer object needs a userPrincipalName. Without them macOS sends the certificate’s subject name, the Mac’s fully qualified domain name, and NPS rejects it with reason code 8 before EAP-TLS starts. Active Directory integration covers the template binding and why a machine with no AD object cannot authenticate to NPS.

Limits

The person approves the profile. It is not installed silently. Every Mac needs a local administrator to approve its profile in System Settings. The agent asks once and reminds up to three times, 24 hours apart. If nobody approves it, the profile stays pending and the Mac has neither the network settings nor the CA trust. macOS enforces the approval, the agent cannot bypass it, and the profile is shown as Not Signed.

A change to the profile needs approval on every Mac again. The SSID and the other settings in the group’s macOS profile section, the group’s name, the CAs the profile carries (including a replacement of one of their certificates), the issuing CA and the licensee name all end up in the profile. Moving between Free and Pro capability counts as a change, and so does a new licensee name. Plan each of them as a new rollout.

EAP-TLS with the machine certificate, on Wi-Fi, one network per group. There is no PEAP, EAP-TTLS or EAP-FAST and no username and password. There is no wired 802.1X option and no proxy setting. A group delivers one SSID and a Mac is in one group, so a Mac has one managed network. A user certificate is not tied to the Wi-Fi, and choosing The logged-in user under Authenticate as gives a network that cannot use the machine certificate.

Removal is manual. Turning the setting off, moving a Mac out of the group or uninstalling the agent leaves the installed profile and the SSID’s identity preference where they are, and uninstalling the agent keeps the certificates it issued. The agent only forgets its own state and deletes its staged copy of the file. An administrator removes the profile in System Settings.

Binding the certificate to the SSID is a keychain write, and it can fail. macOS can raise an authorisation prompt for it. If the write fails, the agent tries up to three times, an hour apart. After that the person can still choose the certificate by hand on the Mac.

The user agent adds one prompt. On a Mac that also runs the user agent, the person sees a one-time prompt to trust the certificate chain in their login keychain.

It is for Macs only. The Windows agent installs the machine certificate and does not create Wi-Fi profiles, and there is nothing for iPhones or iPads.

Each Mac’s machine certificate counts toward your certificate pool. A Free licence allows 10 devices and 10 certificates in total, across every way of issuing one. See the pricing page for what each edition includes.