Skip to main content
Skip to main content

Android - TTLS + PAP Configuration

Configure Android devices to connect to IronWifi WPA-Enterprise wireless networks using EAP-TTLS with PAP inner authentication. This method is essential for integrating with external identity providers like Microsoft Entra ID (without password hash sync), LDAP directories, and legacy systems that don't support MSCHAPv2.

Overview​

EAP-TTLS creates a secure TLS tunnel and uses PAP for inner authentication. This method is useful when integrating with external identity providers that don't support MSCHAPv2.

Prerequisites​

  • Android 10 or later
  • Valid IronWifi user credentials
  • Wireless network configured with WPA2-Enterprise

Configuration Steps​

Android 10 and Later​

  1. Open Settings > Network & Internet > Wi-Fi
  2. Tap your enterprise network (or tap Add network)
  3. Configure the following settings:
    • EAP method: TTLS
    • Phase 2 authentication: PAP
    • CA certificate: Use system certificates (or select specific CA)
    • Domain: Your RADIUS server domain (e.g., 
      radius.ironwifi.com
      )
    • Identity: Your username (usually email address)
    • Anonymous identity: Leave blank or enter 
      anonymous
    • Password: Your password
  4. Tap Connect

Android 9 and Earlier​

  1. Open Settings > Wi-Fi
  2. Tap your enterprise network
  3. Configure:
    • EAP method: TTLS
    • Phase 2 authentication: PAP
    • CA certificate: Do not validate (or select certificate)
    • Identity: Your username
    • Password: Your password
  4. Tap Connect

Certificate Configuration​

Using System Certificates (Android 10+)​

  1. Select CA certificate: Use system certificates
  2. Enter Domain: 
    radius.ironwifi.com
    (or your RADIUS hostname)

Installing a Custom CA Certificate​

If your organization uses a private CA:

  1. Download the CA certificate to your device
  2. Open Settings > Security > Encryption & credentials
  3. Tap Install a certificate > CA certificate
  4. Select the downloaded certificate file
  5. When configuring Wi-Fi, select your installed certificate

Identity Privacy​

EAP-TTLS supports identity privacy (anonymous outer identity):

  • Outer Identity: Sent unencrypted (use 
    anonymous@yourdomain.com
    )
  • Inner Identity: Your actual username, sent encrypted inside the TLS tunnel

To configure:

  1. Enter your real username in the Identity field
  2. Enter 
    anonymous
    or 
    anonymous@yourdomain.com
    in the Anonymous identity field

MDM Deployment​

For enterprise deployment via MDM (Mobile Device Management):

Android Enterprise (Work Profile)​

Create a Wi-Fi configuration profile with:

  • SSID: Your network name
  • Security: WPA2-Enterprise
  • EAP type: TTLS
  • Phase 2: PAP
  • Identity: 
    ${user.email}
    (variable)
  • Anonymous identity: 
    anonymous
  • Certificate: Deploy CA certificate

Troubleshooting​

"Authentication Problem" Error​

  1. Verify your username and password
  2. Check that your account is active in IronWifi
  3. Ensure PAP is enabled on the RADIUS server
  4. Try removing and re-adding the network

Certificate Validation Failed​

  1. Check the CA certificate is correctly installed
  2. Verify the domain name matches the RADIUS server
  3. Ensure the certificate hasn't expired

Cannot Connect After Android Update​

  1. Remove the saved network
  2. Re-enter credentials
  3. May need to reinstall CA certificate

Use Cases​

EAP-TTLS + PAP is particularly useful for:

  • Microsoft Entra ID integration without password hash sync
  • LDAP authentication with external directories
  • Legacy systems that don't support MSCHAPv2
  • Third-party identity providers