We will create a wireless Security Profile for the wireless interface using EAP-TLS authentication and for each connecting client.Ĭ) CONFIGURE Wireless Interface: Finally, we will create a wireless interface specifying the wireless Security Profile for the interface. This will be used by the wireless interface using EAP-TLS authentication.Ĭlient(s): Create a certificate for EACH Client connecting to the SSID using the wireless interface we configure for EAP-TLS.Ĭertificate Authority: This certificate used to create a Chain of Trust for certs by signing both Client & Server certs.ī) CONFIGURE Wireless Security Profiles: Specify the certificates in Wireless Security Profiles. Server: Create a Certificate for MikroTik side of EAP-TLS connection. CONFIGURATION PROCESS OVERVIEW: MikroTik ROUTERĪ) CREATE CERTIFICATES: (3) types of certs must be created: But you MUST review and change my place holders and default values including the certificate export passphrase before executing commands in this tutorial.

The RouterOS CLI commands offered in this tutorial make excellent templates. YMMV if connecting Windows or other clients using EAP-TLS. Tested & known to work correctly as of 20191214.Ĭertificate Creation Procedures: Tested and known to work with IOS 11-13.3 and OSX Mojave and Catalina clients.

RouterOS Versions: Procedures were documented and developed using ***RouterOS v6.45.1 through v 6.46 ***. Unsuitable for Public Networks: Hotels, airports, cafes, etc cannot configure certificate based access for their large, transient WiFi user populations.

Higher Administrative Burden: Creating certificates for each WiFi user and configuring their access requires more effort than setting a shared password.

Traffic Encrypted between Client & Router: The ' TLS' part of 'EAP- TLS' ensures traffic between client & router is encrypted.

A Certificate validates the identity of both users and the AP they're connecting to

Identity Validation: WPA2 password auth only proves a connecting WiFi user knows a password.Granular Access Control: Access can be both granted and restricted on a certificate basis, unlike WPA2 authentication where all users share the same password for the SSID.Using EAP-TLS certificates to authenticate WiFi clients: Upsides:

Mikrotik routeros v6 email config