Unable to connect to WPA2 Enterprise Network

[Basstrom87]

Hardware:

Board: ESP32 Dev Module
Core Installation version: 1.0.1
IDE name: Arduino IDE and Platform.io
Flash Frequency: 80Mhz?
PSRAM enabled: no
Upload Speed: 115200
Computer OS: MacOS Mojave

Description:

Can not connect to WPA2 Enterprise Network.

Can see on the RADIUS log it's trying to connect but throws up a EAP Error 23

I'm assuming that it's something to do with the certificate and unsure how it should be implemented so use the certificate or if I have formatted the certificate correctly. There seems to be multiple ways to do it online and unsure which is the correct way.

Sketch:

#include <Arduino.h>
#include <WiFi.h>
#include "esp_wifi.h"
#include "esp_wpa2.h"

#define EAP_IDENTITY "---------"
#define EAP_PASSWORD "---------"
const char* ssid = "SHS_Aruba";

const char* ca_pem = "-----BEGIN CERTIFICATE-----\n"
"MIIFqjCCA5KgAwIBAgIQEdOJY2465aVG9bW90moH4TANBgkqhkiG9w0BAQsFADBH\n"
"MRMwEQYKCZImiZPyLGQBGRYDbGFuMRYwFAYKCZImiZPyLGQBGRYGc2hzd2luMRgw\n"
"FgYDVQQDEw9TYWxpc2J1cnkgSFMgQ0EwHhcNMTYwODMwMDQzNDM4WhcNNDYwODMx\n"
"MDQ0NDM1WjBHMRMwEQYKCZImiZPyLGQBGRYDbGFuMRYwFAYKCZImiZPyLGQBGRYG\n"
"c2hzd2luMRgwFgYDVQQDEw9TYWxpc2J1cnkgSFMgQ0EwggIiMA0GCSqGSIb3DQEB\n"
"AQUAA4ICDwAwggIKAoICAQC1tpr2OB80TDYTyFXoJVbnuw45oSZtFIDOZWjemIhF\n"
"k5UyLX8C8tGlRMlozkVZExSzPyL0Ci/8VHdKpAcJ9rP3R2EAGA7busU1XCiSjNSP\n"
"otLCGO2gFKIItFs/NG/YkgeGjiMhAnfyeo5/6aqZM43raGmhVH8Jt9LH18+QGjKL\n"
"GdDZuhNKtYH+NMT99x6SRuhXB25kOTLt12q0GCJTNT6/g76veIpIfprctJFrCfnC\n"
"VIQGqUuon10nrPLNn/gB5Ke/gLei5NAludEeivoPSQd1UF3dPfiaXVCi2uwcjvB5\n"
"J595XEleN6N+Iw1t0xYtHtJkVF4HZZAFoYbtwfvxrI5YJVPAOcfSPq9joN3z/xQl\n"
"cIKvmpZ/6/A8StsAGviV6qPI/9oKhuWoqT1+qV3nkOPw+BHhVsH2a0Rtm9J1Xi9V\n"
"aUvSKImEGazXNVW+m5U2Hm4S4Q1V3MwGDZ5T5yGfXzLwdFmlUO3/sdTK/vd6+n6+\n"
"XHhWidp9rN5D97G8id6hxNxVGg4HpQI6hA5Y313eMrncKZPtE55tVX2spYCObOsI\n"
"AcskYKqFHLDjqaZEPumlHL5ogliB2STaxt2CgUaeCdKxnuP/nqrdDwV9+DjD1VfU\n"
"RBsY5Zo2WrrRvcOYm+WsAnWTUvq50mGBqntFjVFTeAZt+r4VYhLw+DnNlbRisAkV\n"
"VwIDAQABo4GRMIGOMBMGCSsGAQQBgjcUAgQGHgQAQwBBMA4GA1UdDwEB/wQEAwIB\n"
"hjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR42TyJivXOFeptm+dVx3C4Kcgw\n"
"sDASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBTwWdz8Hj8yFN2n\n"
"2wQpTHI8S6bUzTANBgkqhkiG9w0BAQsFAAOCAgEACaTvpp/Xk1bOqfs82n7SWPpR\n"
"uDctAC/zzreTIR8/UJ5p6tzPkAosK57MQLbpodmFKC+M3DvlYDwOv+cNxPj6y+Ji\n"
"bmFKCIZcMjjjnW2ewTGkN1MjCxcjafd0Y8t+Y0xJJy+bNQLQeiuOxWzjDozJST9k\n"
"S675gvTNQQRxbgqgb5gDiTwVOKj20uIab6GJQk+twZ6lZN+XXyoPybh/hGbpeJrS\n"
"uMhbcAt9rAiR9ouDpvDInyt2mXCCtpDqxCM/jUzzsXdaGRCVC18dHj8rMEnIwQCf\n"
"uVres0bU6bxSseU5BWx23ErEglru77bvJ3Y4nEcuP8ODTK5ntuBwY8E9o6uyqe0Q\n"
"cca/rKFecqfHIBckEtoECCWxfzDK1z52MYqsO4R/XfS8L+KJZAe4at7ARcywRhUk\n"
"aa9TvZi8wc8f4rNxOX5mvIh3AZjTFgNGG2/B2gpvdOAPNiDyzmRk3kq18kd0T4WP\n"
"QnDYZ8fSlAu+5BHvwNRxW4NSQwsh+R8A64ovM7p98dctTh0ogkXjRYJyDqxlE1GO\n"
"wDhSBdOM+w5cr5XGYAph5cBpGEgKM0jrtMMO2KiPNtDjJGO1bwYm9Y5J58oSU3LA\n"
"U5Vhq6YlArz8cpziydZw3YkRi9FXwYx+v5Bnaq16FE3MJuVTNxer0l7+FBrEnh0/\n"
"9CcdA/blDouY6bGULa4=\n"
"-----END CERTIFICATE-----\n\0";

void setup() {
  WiFi.mode(WIFI_MODE_STA); 
  esp_log_level_set("*", ESP_LOG_DEBUG);
  
  Serial.begin(115200);
  delay(10);
  Serial.println();
  Serial.print("Connecting to network: ");
  Serial.println(ssid);

  WiFi.disconnect(true);
  esp_wifi_sta_wpa2_ent_clear_ca_cert();
  esp_wifi_sta_wpa2_ent_clear_identity();
  esp_wifi_sta_wpa2_ent_clear_username();
  esp_wifi_sta_wpa2_ent_clear_password();


  esp_wifi_sta_wpa2_ent_set_identity((uint8_t *)EAP_IDENTITY, strlen(EAP_IDENTITY)); //provide identity
  esp_wifi_sta_wpa2_ent_set_username((uint8_t *)EAP_IDENTITY, strlen(EAP_IDENTITY)); //provide username --> identity and username is same
  esp_wifi_sta_wpa2_ent_set_password((uint8_t *)EAP_PASSWORD, strlen(EAP_PASSWORD)); //provide password
  esp_wifi_sta_wpa2_ent_set_ca_cert((uint8_t *)ca_pem, strlen(ca_pem));
  esp_wpa2_config_t config = WPA2_CONFIG_INIT_DEFAULT(); //set config settings to default
  esp_wifi_sta_wpa2_ent_enable(&config); //set config settings to enable function

  
  WiFi.begin(ssid);
  
  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }
  
  Serial.println("");
  Serial.println("WiFi connected");
  Serial.println("IP address set: "); 
  Serial.println(WiFi.localIP()); //print LAN IP
}
void loop() {
  if (WiFi.status() == WL_CONNECTED) {
    Serial.println("Wifi is still connected with IP: "); 
    Serial.println(WiFi.localIP());   //inform user about his IP address
  }else if (WiFi.status() != WL_CONNECTED) { //if we lost connection, retry
    WiFi.begin(ssid);      
  }
  while (WiFi.status() != WL_CONNECTED) { //during lost connection, print dots
    delay(500);
    Serial.print(".");
  }
}

Debug Messages:

rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff0018,len:4
load:0x3fff001c,len:1100
load:0x40078000,len:10088
load:0x40080400,len:6380
entry 0x400806a4
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 0 [D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
- WIFI_READY

Connecting to network: SHS_Aruba
I (196) wifi: flush txq
I (197) wifi: stop sw txq
I (197) wifi: lmac stop hw txq
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 3 - STA_STOP
I (201) wpa: WPA2 ENTERPRISE VERSION: [v2.0] enable

I (213) wifi: mode : sta (24:0a:c4:1c:9b:88)
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 0 - WIFI_READY
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
I (355) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
.I (1085) wifi: state: init -> auth (b0)
I (1090) wifi: state: auth -> assoc (0)
I (1095) wifi: state: assoc -> run (10)
I (1095) wpa: wpa2_task prio:2, stack:6656

.I (2198) wpa: >>>>>wpa2 FAILED

.........................................................I (31096) wifi: state: run -> init (200)
I (31096) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (31096) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (31101) wifi: state: init -> auth (b0)
I (31112) wifi: state: auth -> assoc (0)
I (31118) wifi: state: assoc -> run (10)
I (31118) wpa: wpa2_task prio:2, stack:6656

..I (32319) wpa: >>>>>wpa2 FAILED

.........................................................I (61119) wifi: state: run -> init (200)
I (61119) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (61119) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (61124) wifi: state: init -> auth (b0)
I (61129) wifi: state: auth -> assoc (0)
I (61135) wifi: state: assoc -> run (10)
I (61135) wpa: wpa2_task prio:2, stack:6656

.I (62320) wpa: >>>>>wpa2 FAILED

.........................................................I (91139) wifi: state: run -> init (200)
I (91139) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (91139) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (91144) wifi: state: init -> auth (b0)
I (91166) wifi: state: auth -> assoc (0)
I (91233) wifi: state: assoc -> run (10)
I (91234) wpa: wpa2_task prio:2, stack:6656

............................................................I (121234) wifi: state: run -> init (200)
I (121235) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 5 - STA_DISCONNECTED
[W][WiFiGeneric.cpp:357] _eventCallback(): Reason: 204 - HANDSHAKE_TIMEOUT
I (121247) wifi: flush txq
I (121249) wifi: stop sw txq
I (121252) wifi: lmac stop hw txq
I (121262) wifi: mode : sta (24:0a:c4:1c:9b:88)
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 0 - WIFI_READY
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
.I (121385) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (121385) wifi: state: init -> auth (b0)
I (121391) wifi: state: auth -> assoc (0)
I (121406) wifi: state: assoc -> run (10)
I (121407) wpa: wpa2_task prio:2, stack:6656

.I (122511) wpa: >>>>>wpa2 FAILED

.........................................................I (151407) wifi: state: run -> init (200)
I (151408) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (151408) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (151413) wifi: state: init -> auth (b0)
I (151421) wifi: state: auth -> assoc (0)
I (151426) wifi: state: assoc -> run (10)
I (151427) wpa: wpa2_task prio:2, stack:6656

..I (152641) wpa: >>>>>wpa2 FAILED

.........................................................I (181428) wifi: state: run -> init (200)
I (181428) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (181429) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (181433) wifi: state: init -> auth (b0)
I (181447) wifi: state: auth -> assoc (0)
I (181451) wifi: state: assoc -> run (10)
I (181451) wpa: wpa2_task prio:2, stack:6656

...........I (187571) wpa: >>>>>wpa2 FAILED

...............................................I (211451) wifi: state: run -> init (200)
I (211452) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (211452) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (211457) wifi: state: init -> auth (b0)
I (211469) wifi: state: auth -> assoc (0)
I (211473) wifi: state: assoc -> run (10)
I (211473) wpa: wpa2_task prio:2, stack:6656

.............I (217625) wifi: bcn_timout,ap_probe_send_start
.....I (220127) wifi: ap_probe_send over, resett wifi status to disassoc
I (220127) wifi: state: run -> init (100)
I (220127) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 5 - STA_DISCONNECTED
[W][WiFiGeneric.cpp:357] _eventCallback(): Reason: 200 - BEACON_TIMEOUT
I (220145) wifi: flush txq
I (220147) wifi: stop sw txq
I (220150) wifi: lmac stop hw txq
I (220160) wifi: mode : sta (24:0a:c4:1c:9b:88)
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 0 - WIFI_READY
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
I (220283) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (220284) wifi: state: init -> auth (b0)
I (220288) wifi: state: auth -> assoc (0)
I (220293) wifi: state: assoc -> run (10)
E (220293) wpa: WPA2: wpa2 sm not null, deinit it
I (220295) wpa: wpa2_task prio:2, stack:6656

.I (221426) wpa: >>>>>wpa2 FAILED

.........................................................I (310362) wifi: state: run -> init (200)
I (310363) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (310363) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (310368) wifi: state: init -> auth (b0)
..I (311372) wifi: state: auth -> init (200)
I (311372) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 5 - STA_DISCONNECTED
[W][WiFiGeneric.cpp:357] _eventCallback(): Reason: 2 - AUTH_EXPIRE
I (311383) wifi: flush txq
I (311385) wifi: stop sw txq
I (311389) wifi: lmac stop hw txq
I (311398) wifi: mode : sta (24:0a:c4:1c:9b:88)
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 0 - WIFI_READY
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
.I (311522) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (311522) wifi: state: init -> auth (b0)
I (311524) wifi: state: auth -> assoc (0)
I (311528) wifi: state: assoc -> run (10)
I (311529) wpa: wpa2_task prio:2, stack:6656

.I (312678) wpa: >>>>>wpa2 FAILED

.........................................................I (341532) wifi: state: run -> init (200)
I (341533) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (341533) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (341538) wifi: state: init -> auth (b0)
I (341548) wifi: state: auth -> assoc (0)
I (341571) wifi: state: assoc -> run (10)
I (341572) wpa: wpa2_task prio:2, stack:6656

.I (342694) wpa: >>>>>wpa2 FAILED

.........................................................I (371572) wifi: state: run -> init (200)
I (371573) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (371573) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (371577) wifi: state: init -> auth (b0)
..I (372581) wifi: state: auth -> init (200)
I (372582) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (372582) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (372587) wifi: state: init -> auth (b0)
I (372604) wifi: state: auth -> assoc (0)
I (372619) wifi: state: assoc -> run (10)
I (372620) wpa: wpa2_task prio:2, stack:6656

............................................................I (402620) wifi: state: run -> init (200)
I (402621) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 5 - STA_DISCONNECTED
[W][WiFiGeneric.cpp:357] _eventCallback(): Reason: 204 - HANDSHAKE_TIMEOUT
I (402632) wifi: flush txq
I (402634) wifi: stop sw txq
I (402638) wifi: lmac stop hw txq
I (402648) wifi: mode : sta (24:0a:c4:1c:9b:88)
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 0 - WIFI_READY
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
[D][WiFiGeneric.cpp:342] _eventCallback(): Event: 2 - STA_START
.I (402771) wifi: new:<1,0>, old:<1,0>, ap:<255,255>, sta:<1,0>, prof:1
I (402771) wifi: state: init -> auth (b0)
I (402773) wifi: state: auth -> assoc (0)
I (402780) wifi: state: assoc -> run (10)
I (402780) wpa: wpa2_task prio:2, stack:6656

.I (403877) wpa: >>>>>wpa2 FAILED

[lbernstone]

The example in the WiFi library was pretty tightly written around a specific network (Eduroam). You may want to take a look at the esp-idf example to see how to use user certs.

[Basstrom87]

The example in the WiFi library was pretty specifically written around a specific network (Eduroam). You may want to take a look at the esp-idf example to see how to use user certs.

Thanks for the quick reply, I only need the Root CA installed, other than that I don't need any certificates as what I'm planning on using them for doesn't require access to outside our network.

I'm attempting now to work through the example and I'll report back.

Ideally I would like to have this in an Arduino sketch form as a template for my students to use these devices.

[martinius96]

@Basstrom87
Hey, I have published some examples for connection to eduroam networks there:
https://github.com/espressif/arduino-esp32/tree/master/libraries/WiFi/examples/WiFiClientEnterprise
And also for multiple IoT clouds, HTTP, MQTT, HTTPS requests examples in my repo: https://github.com/martinius96/ESP32-eduroam

[Basstrom87]

@Basstrom87
Hey, I have published some examples for connection to eduroam networks there:
https://github.com/espressif/arduino-esp32/tree/master/libraries/WiFi/examples/WiFiClientEnterprise
And also for multiple IoT clouds, HTTP, MQTT, HTTPS requests examples in my repo: https://github.com/martinius96/ESP32-eduroam

Hey Martinius96,
Thanks for the reply. I had tried your WiFiClientEnterprise example, unfortunately it didn't work, won't get past part of the authentication process, pretty sure its to do with the self signed certificate we have here.
Thankfully the IT department have set up a new VLAN just for devices like the ESP32 with MAC address filtering on it, it doesn't have access to the internet through it but can access what I need it to through it and it's just WPA2 Personal security on it so that's how I'm getting around it.

Thanks again for your suggestions :)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This stale issue has been automatically closed. Thank you for your contributions.

[hopkinskong]

@Basstrom87 I am using esp-idf and I forgot to turn on WPA2 Enterprise in component config. After turning it on, it works flawlessly.

[Basstrom87]

@hopkinskong
I tried that and still didn’t get any joy 😔

What kind of enterprise network are you trying to connect to?

[Jonel-Bacroya]

@hopkinskong
how do you " turn on WPA2 Enterprise in component config" ?
I'm new to ESP32 and clueless on WPA2.
I'm getting this error in the radius server:
""EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate""

TIA!