How to Connect to Wi-Fi Using TTLS + PAP on Linux

TTLS + PAP is a secure Wi-Fi authentication method used in enterprise and academic networks. This guide covers how to connect using both graphical tools and the command line on a Linux system.

Option 1: Using NetworkManager (GUI)

1. Click the Wi-Fi icon in your system tray and select the network.
2. When prompted for credentials, configure as follows:

• Security: WPA & WPA2 Enterprise
• Authentication: Protected EAP (TTLS)
• Anonymous Identity: Optional (e.g., anonymous@example.com)
• CA Certificate: (Use system CA or select certificate file)
• PEAP Version: Leave default (if applicable)
• Inner Authentication: PAP
• Username (Identity): Your provided login
• Password: Your account password

Click Connect.

Option 2: Using wpa_supplicant (Command Line)

1. Create/Edit Your Config File

sudo nano /etc/wpa_supplicant/wpa_supplicant.conf

Add the following:

network={
    ssid="YourNetworkSSID"
    key_mgmt=WPA-EAP
    eap=TTLS
    identity="your-username"
    anonymous_identity="anonymous@example.com"
    password="your-password"
    ca_cert="/etc/ssl/certs/ca-cert.pem"
    phase2="auth=PAP"
}

2. Connect Using wpa_supplicant

sudo wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf

Then request IP address:

sudo dhclient wlan0

Troubleshooting

• Make sure ca_cert points to a valid CA file, or use ca_cert="SYSTEM" if supported.
• Check syslog or dmesg for connection errors.
• Ensure wpa_supplicant is installed and NetworkManager is disabled (if using CLI).

Security Tip

Always validate server certificates to prevent man-in-the-middle attacks. You can download latest CA file from IronWiFi PKI Infrastructure page and verify domain radius.ironwifi.com.