Skip to main content
Skip to main content

Chromebook - TTLS + PAP Configuration

Configure Chromebook devices to connect to IronWifi WPA-Enterprise wireless networks using EAP-TTLS with PAP inner authentication. This method is essential for integrating with external identity providers like Microsoft Entra ID (without password hash sync), LDAP directories, and legacy systems that don't support MSCHAPv2.

Overview​

EAP-TTLS creates a secure TLS tunnel and uses PAP for inner authentication. This method is useful when integrating with external identity providers that don't support MSCHAPv2.

Prerequisites​

  • ChromeOS device
  • Valid IronWifi user credentials
  • Wireless network configured with WPA2-Enterprise

Configuration Steps​

Manual Configuration​

  1. Click the network icon in the system tray (bottom-right corner)
  2. Click Settings (gear icon)
  3. Select Network > Wi-Fi
  4. Click Add connection (or select the enterprise network)
  5. Configure the following:
    • SSID: Your network name
    • Security: WPA/WPA2 Enterprise (802.1X)
    • EAP method: EAP-TTLS
    • Phase 2 authentication: PAP
    • Server CA certificate: Default or select installed certificate
    • Identity: Your username (usually email address)
    • Password: Your password
    • Anonymous identity: 
      anonymous
      (optional, for privacy)
  6. Click Connect

Certificate Configuration​

Using Default Certificates​

ChromeOS includes a set of trusted CA certificates. If IronWifi uses a publicly trusted CA:

  1. Select Server CA certificate: Default
  2. No additional certificate installation needed

Installing a Custom CA Certificate​

If your organization uses a private CA:

  1. Download the CA certificate file (
    .pem
    or 
    .crt
    )
  2. Open Settings > Security and Privacy
  3. Select Certificates > Authorities
  4. Click Import and select the CA certificate file
  5. Check Trust this certificate for identifying websites
  6. Click OK
  7. When configuring Wi-Fi, select your imported certificate

Google Admin Console Deployment​

For managed Chromebooks, deploy the configuration via Google Admin Console:

  1. Sign in to Google Admin Console (admin.google.com)
  2. Navigate to Devices > Networks > Wi-Fi
  3. Click Add Wi-Fi
  4. Configure:
    • Name: Your network name
    • SSID: Your SSID
    • Security type: WPA/WPA2 Enterprise (802.1X)
    • Extensible authentication protocol: EAP-TTLS
    • Inner protocol: PAP
    • Outer identity: 
      anonymous
  5. Under Server certificate authority, upload your CA certificate
  6. Under User credentials, configure as needed
  7. Click Save

Identity Privacy​

EAP-TTLS supports identity privacy (anonymous outer identity):

  • Outer Identity: Sent unencrypted (use 
    anonymous@yourdomain.com
    )
  • Inner Identity: Your actual username, sent encrypted inside the TLS tunnel

Troubleshooting​

Cannot Connect to Network​

  1. Verify your username and password
  2. Check that your account is active in IronWifi
  3. Remove the saved network and re-add it
  4. Ensure PAP is enabled on the RADIUS server

Certificate Errors​

  1. Verify the CA certificate is correctly imported
  2. Check the certificate hasn't expired
  3. Try setting Server CA certificate to Do not check

Network Disappears After Restart​

  1. Re-enter network settings
  2. For managed devices, verify Google Admin Console policy is applied
  3. Check that ChromeOS is up to date

Use Cases​

EAP-TTLS + PAP is particularly useful for:

  • Microsoft Entra ID integration without password hash sync
  • LDAP authentication with external directories
  • Legacy systems that don't support MSCHAPv2
  • Google Workspace environments with third-party RADIUS